TOP Literature Database When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification
Computing Research Repository (CoRR)
When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification
AI Security Portal bot
Information in the literature database is collected automatically.
These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Internet traffic classification is widely used to facilitate network
management. It plays a crucial role in Quality of Services (QoS), Quality of
Experience (QoE), network visibility, intrusion detection, and traffic trend
analyses. While there is no theoretical guarantee that deep learning (DL)-based
solutions perform better than classic machine learning (ML)-based ones,
DL-based models have become the common default. This paper compares well-known
DL-based and ML-based models and shows that in the case of malicious traffic
classification, state-of-the-art DL-based solutions do not necessarily
outperform the classical ML-based ones. We exemplify this finding using two
well-known datasets for a varied set of tasks, such as: malware detection,
malware family classification, detection of zero-day attacks, and
classification of an iteratively growing dataset. Note that, it is not feasible
to evaluate all possible models to make a concrete statement, thus, the above
finding is not a recommendation to avoid DL-based models, but rather empirical
proof that in some cases, there are more simplistic solutions, that may perform
even better.