Encrypted Traffic Analysis (ETA) is a critical area of research for security monitoring in modern networks. Although machine learning- and deep learning-based ETA methods have shown significant promise, they depend heavily on large-scale, manually labeled data. Meanwhile, the research community has released many high-performing ETA models. However, the knowledge embedded in these models remains siloed and difficult to reuse, as they are trained on heterogeneous feature spaces and task semantics. In practice, such models are typically developed independently at different times. Consequently, a unified model cannot be jointly learned from all existing models. Instead, it should learn each model’s knowledge sequentially as it becomes available. These observations raise a key question: Can we construct a unified model that continually learns from multiple existing models? To address this problem, we propose the Dual-Branch Continual Learning (DBCL) framework, which enables a single large language model (LLM)-based student model to continually learn from multiple task-specific teacher models using teacher-generated predictions rather than raw labeled data. DBCL represents heterogeneous traffic features and task semantics in a shared semantic space and mitigates catastrophic forgetting via a dual-branch architecture that balances rapid knowledge acquisition with long-term retention. Experiments across four publicly available datasets of encrypted traffic demonstrate that DBCL consistently outperforms competitive continual learning baselines. Furthermore, we provide information-theoretic and optimization-theoretic analyses that offer insights into the effectiveness of DBCL, highlighting its potential as a promising ETA approach.

With the widespread adoption of encryption technologies, the proportion of encrypted network traffic has surged, posing new challenges for detecting encrypted malicious traffic. Although existing methods have made some progress in this field, they still face the following challenges in real-world network environments: (1) the detection performance on minority class samples is unsatisfying under imbalanced data distribution; (2) the false positive rate (FPR) for benign traffic is too high to meet the detection needs in large-scale traffic scenarios. To address these issues, we propose a novel Transport Layer Security (TLS) behavior flow-based malicious traffic detection method, which is abbreviated as BFDet. The method employs a three-layer neural network architecture specifically designed for feature aggregation from packet to flow, feature aggregation from flow to behavior flow, and further optimization of behavior flow feature vector. Through hierarchical feature aggregation, BFDet effectively exploits the potential relationships between features of different granularities, improving the detection performance of TLS malicious traffic. Experimental results show that BFDet while maintaining high detection accuracy, reduces the average FPR of benign traffic in a real network traffic dataset to 0.005

Cyber Threat Intelligence (CTI) reports contain resourceful intelligence on cyber-attack campaigns, which provides great help for security analysts to infer attack trends and enhance their defenses. However, due to the diversity of report content and writing styles, current intelligence extraction is mostly based on time-consuming manual efforts. Moreover, existing automatic methods generally neglect the importance of background knowledge and produce inexact extraction results. These problems prevent the effective utilization and sharing of intelligence from CTI reports. In this paper, we primarily focus on the automatic extraction of attack technique (AT) intelligence, which reveals patterns of attack behaviors and hardly changes over time. We propose a novel automatic AT extraction pipeline for CTI reports (AECR). AECR explores the feasibility of extracting AT intelligence based on a fined-tuned large language model (LLM). Particularly, we endow the selected LLM with enhanced domain-specific knowledge to improve its comprehension of AT-relevant content and alleviate the hallucination problem. Experimental results demonstrate that AECR outperforms state-of-the-art methods by a wide margin with a reasonable time cost. Specifically, we improve the accuracy, precision, recall, and F1-score by 108%, 37.2%, 22.4%, and 67.5% respectively. To the best of our knowledge, AECR is the first to perform AT extraction based on fine-tuned LLM.

To train robust malicious traffic identification models under noisy labeled datasets, a number of learning with noise labels approaches have been introduced, among which parallel training methods have been proved to be effective. Parallel training methods tend to select samples with disagreement to mitigate the risk of self-control degradation. However, it also introduces noisy knowledge into training. In this letter, we try to avoid introducing noisy knowledge by enhancing the consistency of the representations of parallel networks. Meanwhile, the two networks are heterogeneous and introduce information from different modalities, thus mitigating the risk of self-control degradation from multiple perspectives.

Since the traffic of novel attacks exceeds current knowledge, realistic traffic labeling methods are prone to mislabeling, which has a significant impact on machine learning-based intrusion detection systems. Data cleaning typically relies on the ability of supervised deep neural networks to learn correct knowledge. Under high noise conditions, noisy labels can affect a supervised network and render it ineffective. To clean traffic datasets under high noise conditions, we propose an unsupervised learning-based data cleaning framework (called ULDC) that does not rely on labels and powerful supervised networks, hence reducing the impact of noisy labels. ULDC evaluates the confidence of observed labels through the distribution and similarity of samples in low dimensions. Moreover, ULDC maximizes the retention of hard samples through adaptive intra-class threshold evaluation, preserving more hard samples for training and improving generalization. In evaluations of ULDC on the CIRA-CIC-DoHBrw-2020 dataset, the percentage of data correction reached more than 75% under high noise, which is better than that of the state-of-the-art methods. ULDC is applicable to traffic data cleaning in both traditional networks and novel networks such as the Internet of Things and mobile networks, and it has been validated on datasets including CIC-IDS-2017 and IoT-23.

Incremental search services in search engines update the suggestion list for users by sending real-time requests. Focusing on the information leakage of encrypted search traffic, a side- channel analysis method on Chinese search is proposed. Leveraging the distinguishability of packet length increments and time intervals, a three-stage analysis model is constructed to identify user queries. Experimental results show that the performance in four commonly used Chinese search engines achieves the theoretical quantified value. The identification accuracy for the set containing 1.4x10(5) monitored queries reaches 76%. Finally, four mitigation methods are evaluated to demonstrate that side-channel analysis can be effectively defended by blocking the information leakage sources.

By analyzing and extracting information such as packet size and timing leaked during Web application communication, side channel attack on encrypted network traffic is able to recognize users' identity and behavior and even restore the original data entered by users. A model of side channel attack on encrypted network traffic according to information theory was developed. Based on the unified model, the methods and results of representative attacks such as fingerprinting attacks, keystroke attacks and speech attacks were analyzed in detail. Furthermore, defense methods of hiding packet size and timing information were discussed. At last, possible research directions were prospected with the frontiers of technology development.

The explosion of information has resulted in incremental search becoming an essential tool for many websites. This technology provides real-time suggestions by sending the current query to the server. Despite encryption, search requests can be leveraged by passive attackers to infer the query typed by the user. In this paper, we show that at least nine of Alexa’s top 50 websites have serious side-channel leaks. More importantly, we use information theory to quantify the leakage and report the upper bound of recognition accuracy that an attacker can achieve. We further develop a generic attack attempting to infer users’ queries by monitoring web search traffic. Experimentally, the attack performance is close to the theoretical bounds. The most vulnerable website allows up to 53% of English queries and 76% of Chinese queries to be identified from 825k and 140k queries, respectively. Overall, our work highlights the prevalence of such side-channel leaks on the Internet and provides insights for developers to help mitigate the threat.

Portable document format（PDF） files are increasingly used to launch cyberattacks due to their popularity and increasing number of vulnerabilities.Many solutions have been developed to detect malicious files,but their accuracy decreases rapidly in face of new evasion techniques.We explore how to improve the robustness of classifiers for detecting adversarial attacks in PDF files.Content replacement and the n-gram are implemented to extract robust features using proposed guiding principles.In the two-stage machine learning model,the objects are divided based on their types,and the anomaly detection model is first trained for each type individually.The former detection results are organized into tree-like information structure and treated as inputs to convolutional neural network.Experimental results show that the accuracy of our classifier is nearly 100% and the robustness against evasive samples is excellent.The object features also enable the identification of different vulnerabilities exploited in malicious PDF files.

Abstract Aiming at the problem of insufficient defense ability of fingerprint detection, the anti-reconnaissance model of host fingerprint based on virtual node is proposed. The model constructs periodically reconfigurable virtual nodes, dynamically camouflages the fingerprint information of the host to deceive the detector, and redirect attack traffic targeting virtual nodes to honeypots that can capture and analyze attack behavior. Honeypot, as an active defense technology, can effectively improve the model’s defense capabilities. This paper introduces probabilistic models for the defense model to provide a deeper understanding of the theoretical effect their parameters have for cybersecurity, which quantifies the impact of different parameters on the probability of attack success, such as the number of probes, number of honeypot mapping rules, the virtual node deception rate, the honeypot detection rate and allowable losses. Furthermore, our prototype system using Software Defined Network (SDN) and Data Plane Development Kit (DPDK) verifies the effectiveness of the model against reconnaissance.

Portable document format (PDF) files are increasingly used to launch cyberattacks due to their popularity and increasing number of vulnerabilities. Many solutions have been developed to detect malicious files, but their accuracy decreases rapidly in face of new evasion techniques. We explore how to improve the robustness of classifiers for detecting adversarial attacks in PDF files. Content replacement and the n-gram are implemented to extract robust features using proposed guiding principles. In the two-stage machine learning model, the objects are divided based on their types, and the anomaly detection model is first trained for each type individually. The former detection results are organized into tree-like information structure and treated as inputs to convolutional neural network. Experimental results show that the accuracy of our classifier is nearly 100% and the robustness against evasive samples is excellent. The object features also enable the identification of different vulnerabilities exploited in malicious PDF files.