Cyber Threat Intelligence (CTI) reports contain resourceful intelligence on cyber-attack campaigns, which provides great help for security analysts to infer attack trends and enhance their defenses. However, due to the diversity of report content and writing styles, current intelligence extraction is mostly based on time-consuming manual efforts. Moreover, existing automatic methods generally neglect the importance of background knowledge and produce inexact extraction results. These problems prevent the effective utilization and sharing of intelligence from CTI reports. In this paper, we primarily focus on the automatic extraction of attack technique (AT) intelligence, which reveals patterns of attack behaviors and hardly changes over time. We propose a novel automatic AT extraction pipeline for CTI reports (AECR). AECR explores the feasibility of extracting AT intelligence based on a fined-tuned large language model (LLM). Particularly, we endow the selected LLM with enhanced domain-specific knowledge to improve its comprehension of AT-relevant content and alleviate the hallucination problem. Experimental results demonstrate that AECR outperforms state-of-the-art methods by a wide margin with a reasonable time cost. Specifically, we improve the accuracy, precision, recall, and F1-score by 108%, 37.2%, 22.4%, and 67.5% respectively. To the best of our knowledge, AECR is the first to perform AT extraction based on fine-tuned LLM.

Malicious communication is the most common type of post-exploitation malicious attack behavior. In the long-term and persistent process of post-exploitation malicious communication, attackers continuously encrypt and transmit various types of information stolen from the target network through the established C&C channel. However, existing methods are easily deceived by the variable infrastructure or disguised certificates used by attackers, or cannot fully capture the multifaceted information and their interrelationships in encrypted traffic. To overcome these limitations, in this paper, we propose a multi class detection method for post-exploitation malicious communication traffic based on hypergraph neural networks. This method calculates the cosine similarity between traffic state nodes through session flow statistical features as edges and edge weights to strengthen the correlation structure between session flow nodes. Based on the network communication behavior graph, a hypergraph structure of host layer traffic interaction is constructed. Finally, a multi classification detection model for post-exploitation malicious communication traffic based on hypergraph neural networks is proposed, which uses hyperedge convolution to layer process vertex and hyperedge features, and uses hyperedge pooling to sort and retain effective information by weight, thus better learning hypergraph structural data. The experimental results show that this method can more accurately model the multivariate relationships between communication traffic and effectively achieve multi classification detection of post-exploitation malicious communication traffic.

With the increasing proportion of encrypted traffic in cyberspace, the classification of encrypted traffic has become a core key technology in network supervision.In recent years, many different solutions have emerged in this field.Most methods identify and classify traffic by extracting spatiotemporal characteristics of data flows or byte-level features of packets.However, due to changes in data transmission mediums, such as fiber optics and satellites, temporal features can exhibit significant variations due to changes in communication links and transmission quality.Additionally, partial spatial features can change due to reasons like data reordering and retransmission.Faced with these challenges, identifying encrypted traffic solely based on packet byte-level features is significantly difficult.To address this, we propose a universal packet-level encrypted traffic identification method, Combo Packet.This method utilizes convolutional neural networks to extract deep features of the current packet and its contextual information and employs spatial and channel attention mechanisms to select and locate effective features.Experimental data shows that Combo Packet can effectively distinguish between encrypted traffic service categories (e.g., File Transfer Protocol, FTP, and Peer-to-Peer, P2P) and encrypted traffic application categories (e.g., BitTorrent and Skype).Validated on the ISCX VPN-non VPN dataset, it achieves classification accuracies of 97.0% and 97.1% for service and application categories, respectively.It also provides shorter training times and higher recognition speeds.The performance and recognition capabilities of Combo Packet are significantly superior to the existing classification methods mentioned.

Website Fingerprinting (WF) enables a passive attacker to identify which website a user is visiting over an encrypted tunnel. Current WF attacks have two strong assumptions: (i) specific tunnel, i.e., the attacker can train on traffic samples collected in a simulated tunnel with the same tunnel settings as the user, and (ii) pseudo-open-world, where the attacker has access to training samples of unmonitored sites and treats them as a separate class. These assumptions, while experimentally feasible, render WF attacks less usable in practice. In this paper, we present Gene Fingerprinting (GF), a new WF attack that achieves cross-tunnel transferability by generating fingerprints that reflect the intrinsic profile of a website. The attack leverages Zero-shot Learning-a machine learning technique not requiring training samples to identify a given class-to reduce the effort to collect data from different tunnels and achieve a real open-world. We demonstrate the attack performance using three popular tunneling tools: OpenSSH, Shadowsocks, and OpenVPN. The GF attack attains over 94% accuracy on each tunnel, far better than existing CUMUL, DF, and DDTW attacks. In the more realistic open-world scenario, the attack still obtains 88% TPR and 9% FPR, outperforming the state-of-the-art attacks. These results highlight the danger of our attack in various scenarios where gathering and training on a tunnel-specific dataset would be impractical.

Website Fingerprinting (WF) is a traffic analysis attack. The potential local adversary can infer the user's web activity by extracting implicit pattern information from traffic traces. Leveraging the latest advances in Deep Learning, the adversary has achieved 98% detection accuracy in closed-world tests. This poses a new challenge to the traditional WF defense methods. In this paper, we propose a new defense method, the proposed dissimilarity measure and local optimal mutation strategy greatly reduce the computational cost. Experimental results show that the method achieves the generation of adversarial traffic trace with shorter preparation times and better defensive effects. Moreover, it also has great potential in the face of more powerful attacks that may emerge in the future.

Website Fingerprinting (WF) enables a local passive attacker to infer which website a user is visiting over an encrypted connection. Classifiers utilizing deep neural networks (DNNs) automatically extract reliable features and have achieved up to 98% accuracy even against Tor. Since DNNs are known to be vulnerable to adversarial examples, several recent studies have exploited adversarial perturbations to defeat WF attacks. These defenses, however, require a high bandwidth overhead that typically exceeds 20% of the original traffic, prohibiting them from real-world deployment. Moreover, many studies on WF defense have been criticized for unrealistic assumptions such as full access to the target model and operating on the entire website trace. In this paper, we leverage adversarial patches—a special type of adversarial example that perturbs only local parts of the input—to control the overhead and enable black-box perturbation. In particular, we propose a new WF defense called Minipatch that injects extremely few dummy packets in real-time traffic to evade the attacker’s classifier. Experimental results demonstrate that Minipatch provides over 97% protection success rate with less than 5% bandwidth overhead, much lower than existing defenses. Moreover, we show that our adversarial patches remain effective in challenging settings, e.g., where dummy packets are injected only on the client-side and where perturbations are applied almost two months later. Finally, we also analyze several potential countermeasures and suggest ways to preserve perturbation effectiveness during deployment.

Incremental search services in search engines update the suggestion list for users by sending real-time requests. Focusing on the information leakage of encrypted search traffic, a side- channel analysis method on Chinese search is proposed. Leveraging the distinguishability of packet length increments and time intervals, a three-stage analysis model is constructed to identify user queries. Experimental results show that the performance in four commonly used Chinese search engines achieves the theoretical quantified value. The identification accuracy for the set containing 1.4x10(5) monitored queries reaches 76%. Finally, four mitigation methods are evaluated to demonstrate that side-channel analysis can be effectively defended by blocking the information leakage sources.

By analyzing and extracting information such as packet size and timing leaked during Web application communication, side channel attack on encrypted network traffic is able to recognize users' identity and behavior and even restore the original data entered by users. A model of side channel attack on encrypted network traffic according to information theory was developed. Based on the unified model, the methods and results of representative attacks such as fingerprinting attacks, keystroke attacks and speech attacks were analyzed in detail. Furthermore, defense methods of hiding packet size and timing information were discussed. At last, possible research directions were prospected with the frontiers of technology development.

The explosion of information has resulted in incremental search becoming an essential tool for many websites. This technology provides real-time suggestions by sending the current query to the server. Despite encryption, search requests can be leveraged by passive attackers to infer the query typed by the user. In this paper, we show that at least nine of Alexa’s top 50 websites have serious side-channel leaks. More importantly, we use information theory to quantify the leakage and report the upper bound of recognition accuracy that an attacker can achieve. We further develop a generic attack attempting to infer users’ queries by monitoring web search traffic. Experimentally, the attack performance is close to the theoretical bounds. The most vulnerable website allows up to 53% of English queries and 76% of Chinese queries to be identified from 825k and 140k queries, respectively. Overall, our work highlights the prevalence of such side-channel leaks on the Internet and provides insights for developers to help mitigate the threat.

Mobile app traffic now accounts for a majority owing to the booming mobile devices and mobile apps. State-of-the-art identification methods, such as DPI and flow-based classifiers, have difficulties in designing features and labeling samples manually. Motivated by the excellence of CNNs in visual object recognition, we propose convolutional autoencoder network (CAEN), a deep learning approach to mobile app traffic identification. Our contributions are two-fold. First, we propose a novel method of converting traffic flows into vision-meaningful images, and thus enable the machine to identify the traffic in a human way. Based on the method, we create an open dataset named IMTD. Second, convolutional autoencoder (CAE) algorithm is introduced into the proposed network model, realizing the automatic feature extraction and the learning from massive unlabeled samples. The experimental results show that the identification accuracy of our approach can reach 99.5%, which satisfies the practical requirement.

The mobile apps mostly communicate with servers via HTTP, which makes port-based method ineffective. Furthermore, depth packet inspection and flow-based classifiers have difficulties in designing features and labeling samples manually. Motivated by the excellence of computer vision, this paper proposed a method of mobile app traffic identification based on visual perception features. First, it converted the app traffic flows into vision-meaningful images. Collecting real traffic from the network gateway, it created the IMTD17 dataset. Then, it designed a two-dimensional convolutional perception network (2D-CPN) with the ability of visual feature extraction. The network realized the learning of massive unlabeled samples by the convolutional autoencoder, and used multi-class regression to create the mapping from the latent feature to the app categories. The experimental results show that the identification accuracy of the approach satisfies the practical requirement.

Traffic identification is a fundamental issue in network security. Traditional methods, such as depth packet inspection (DPI) and flow-based classifiers, have difficulties in labeling massive samples and extracting features manually. Motivated by the achievements in computer vision, we focus on mobile app traffic, proposing a deep learning model based on variational autoencoder network (VEAN). Our contributions are two-fold. First, we propose a novel method of transforming mobile app traffic flows into vision-meaningful images, and thus enable the machine to identify the traffic in a human way. Then, based on the transformation method, we create an open dataset named IMTD17. Second, an improved network model is proposed, where variational autoencoder (VAE) algorithm is introduced into a two-stage learning. The model realizes the learning from massive unlabeled data, and the feasibility of the replacement for manual feature extraction is illustrated by the visualization analysis of the latent features. The experimental results show that the identification accuracy can reach 99.6%, which satisfies the practical requirement.