Multimodal Feature Fusion Based Encrypted Malicious Network Traffic Detecting Approach: Generalizable Models Design

With the development of emerging network technologies and new network protocols, such as industrial Internet, mobile Internet of things and low-altitude intelligent connection networks, the network environments are becoming increasingly complex, posing a severe challenge to the identification of malicious network traffic. Existing deep learning-based approaches often rely on a single feature modality, making it difficult to fully describe the multidimensional behavior patterns of network traffic, thus limiting their generalization ability. To address this challenge, this paper proposes a multimodal feature fusion-based approach for detecting encrypted malicious traffic. The proposed approach treats the packet sequence of network traffic as a text sequence to extract its text modality features, and stacks the original byte stream as an image to extract its image modality features. On the one hand, the text modality uses an attention mechanism to model the relationships between packets within a flow. On the other hand, the image modality employs a segmented Vision Transformer to learn communication patterns from byte-level information such as protocol fields. Then, the inter-flow information and communication pattern information are fused to achieve a deep representation of traffic behavior patterns. In the proposed approach, we design anonymization experiments and corresponding feature extraction strategies to ensure the effectiveness and generalization of the extracted features. Experimental results on five public datasets show that the proposed approach outperforms benchmarks, especially in the task of malicious traffic identification in heterogeneous network environments, with recognition accuracy exceeding 95%.