Abstract:

To supply variant malicious traffic to network intrusion detection systems (NIDS) for evaluating detection models, this paper investigated a concealment transformation method for malicious communication behavior. First, the paper characterized traffic via packet-length sequences; by modifying these sequences, one can guide data-level transformations of malicious traffic to produce realistic and usable variants, thereby altering packet-length-related statistical features to interfere with NIDS detection. Next, based on packetlength sequences, this paper designed a concealment transformation method which selected, as reference traffic, the normal flow whose packetlength sequence most closely matches that of the malicious flow to be transformed, and then apply two strategies—TCP payload padding and segmentation—to adjust the packet sizes in the malicious flow so that its packetlength sequence resembles that of normal traffic, effectively mimicking normal communication behavior. Finally, this paper constructed test datasets using the DoH-Brw and CIC-AAGM datasets. Experimental results show that the variant malicious traffic generated from DoH-Brw achieves an average detection-rate reduction of over 60% across six NIDS, and variants based on CIC-AAGM yield an average reduction of over 30% across four NIDS, thereby demonstrating the effectiveness of proposed method.

Key words: network attacks, traffic obfuscation, malicious traffic