| 引用本文： |
-
欧鲁金,叶晓鸣,孔腾珑,李鑫.基于预训练Longformer的恶意TLS流量检测算法研究[J].信息安全学报,已采用 [点击复制]
- oulujin,yexiaoming,kongtenglong,lixin.Research on Detection Algorithm for Malicious TLS Traffic Based on Pre-Trained Longformer[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 随着网络通信加密技术的快速发展与普及，TLS等加密协议在提升数据传输机密性与通信安全性的同时，也逐渐被高级恶意软件利用作为隐蔽通信信道，用于执行命令控制、敏感数据窃取与恶意载荷传输。传统恶意TLS流量检测方法主要基于流级统计特征与协议元数据进行行为识别，难以有效刻画TLS握手阶段蕴含的复杂时序关联特征与深层上下文语义信息，导致模型对复杂恶意行为的表征能力受限，并在实际网络环境中易产生较高误报率。针对上述问题，本研究提出了一种基于预训练Longformer架构的恶意TLS流量检测算法MFF-IKNN。首先，利用Longformer模型对TLS会话日志进行长上下文语义建模，从握手行为中深度挖掘时序语义特征，构建具有更强判别能力的特征空间；其次，引入结合了中心损失函数的自编码器，对高维特征表示进行压缩与优化，通过增强类间分离性与类内紧凑性，提升特征表示质量；最后，结合基于增量学习的K近邻检测方法实现恶意TLS流量检测，提升模型在面对未知零日威胁、变种攻击演化以及数据分布漂移场景下的适应能力。提出的算法在DataCon2020、CIC-MalAnal-2017、CIC-DoHBrw-2020、CIC-IDS-2017以及BCCC-UDP-QUIC-IDS-2025数据集上进行验证，实验结果表明，该算法的召回率最高达到了100%，准确率、精确率与F1分数分别达到96.46%、96.74%和96.14%以上，同时误报率低至1.28%以下，检测性能优于SOTA方法以及决策树、随机森林等对比算法。 |
| 关键词: TLS流量 Longformer模型 AE 增量学习 |
| DOI： |
| 投稿时间：2026-05-24修订日期：2026-09-09 |
| 基金项目:国家自然科学基金项目（面上项目，重点项目，重大项目） |
|
| Research on Detection Algorithm for Malicious TLS Traffic Based on Pre-Trained Longformer |
|
oulujin, yexiaoming, kongtenglong, lixin
|
| (Chengdu University of Information Technology) |
| Abstract: |
| With the rapid development and widespread popularization of network communication encryption technologies, encryption protocols such as TLS have significantly enhanced data transmission confidentiality and overall communication security. Concurrently, these encrypted channels have increasingly been exploited by advanced malware as covert communication pathways to execute command-and-control operations, sensitive data exfiltration, and malicious payload delivery. Traditional malicious TLS traffic detection methods predominantly rely on flow-level statistical features and protocol metadata for behavioral identification. Consequently, they fail to effectively capture and characterize the intricate temporal correlation features and deep contextual semantic information embedded within the TLS handshake stage. This inherent limitation leads to an inadequate representation capability for complex malicious behaviors and frequently results in relatively high false positive rates in practical network deployment environments. To address these aforementioned challenges, this study proposes an advanced malicious TLS traffic detection algorithm designated as MFF-IKNN, which is constructed upon a pre-trained Longformer architecture. First, the algorithm utilizes the Longformer model to perform comprehensive long-context semantic modeling on TLS session logs, deeply extracting sequential semantic features directly from granular handshake behaviors and thereby constructing a feature space with superior discriminative capabilities. Second, an autoencoder integrated with a center loss function is introduced to compress and optimize the high-dimensional feature representations, effectively improving the overall quality of feature representations by enhancing inter-class separability and intra-class compactness. Finally, by incorporating an incremental learning-based K-Nearest Neighbor detection method, the framework achieves robust malicious TLS traffic detection while substantially improving the model adaptability when encountering unknown zero-day threats, evolving attack variants, and complex data distribution drift scenarios. The proposed algorithm was comprehensively evaluated on five benchmark datasets, namely DataCon2020, CIC-MalAnal-2017, CIC-DoHBrw-2020, CIC-IDS-2017, and BCCC-UDP-QUIC-IDS-2025. Experimental results demonstrate that the proposed method achieves a peak recall rate of up to 100%, with the accuracy, precision, and F1-score exceeding 96.46%, 96.74%, and 96.14%, respectively, while simultaneously maintaining a remarkably low false positive rate below 1.28%. The overall detection performance is superior to existing state-of-the-art methods as well as classical baseline algorithms including Decision Trees and Random Forests. |
| Key words: TLS traffic, Longformer model, AE, incremental learning |
