Scholarlink

<p>With the widespread adoption of network encryption technologies, traditional detection methods increasingly struggle to identify malicious encrypted traffic due to their limited ability to capture structural and behavioral characteristics. To address this issue, this paper proposes a Detachable Convolutional GCN-LSTM (DC-GL) model. The proposed model constructs graph-structured data by integrating protocol-layer features and traffic statistical features extracted from encrypted flows. A Graph Convolutional Network (GCN) is employed to capture structural dependencies among nodes, while a Long Short-Term Memory (LSTM) network models the temporal dynamics of traffic behavior. To improve computational efficiency and feature extraction performance, detachable convolution is introduced into the GCN layers. In addition, an attention mechanism is incorporated to enhance the representation of critical features. Experimental results demonstrate that the DC-GL model outperforms several mainstream approaches in terms of accuracy, recall, and other key metrics, while also exhibiting faster convergence and greater robustness. These results suggest that DC-GL offers an effective and promising approach for malicious encrypted traffic detection.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A novel encrypted traffic detection model based on detachable convolutional GCN-LSTM

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年7月29日

查看全文
  • Xiaogang Yuan,
  • Jianxin Wan,
  • Dezhi An,
  • Huan Pei

摘要

With the widespread adoption of network encryption technologies, traditional detection methods increasingly struggle to identify malicious encrypted traffic due to their limited ability to capture structural and behavioral characteristics. To address this issue, this paper proposes a Detachable Convolutional GCN-LSTM (DC-GL) model. The proposed model constructs graph-structured data by integrating protocol-layer features and traffic statistical features extracted from encrypted flows. A Graph Convolutional Network (GCN) is employed to capture structural dependencies among nodes, while a Long Short-Term Memory (LSTM) network models the temporal dynamics of traffic behavior. To improve computational efficiency and feature extraction performance, detachable convolution is introduced into the GCN layers. In addition, an attention mechanism is incorporated to enhance the representation of critical features. Experimental results demonstrate that the DC-GL model outperforms several mainstream approaches in terms of accuracy, recall, and other key metrics, while also exhibiting faster convergence and greater robustness. These results suggest that DC-GL offers an effective and promising approach for malicious encrypted traffic detection.