Abstract:

Mining traffic detection is a variable-length data classification task. Existing detection schemes, such as keyword matching and N-gram feature signatures, which are based on local feature classification methods, fail to fully utilize the global features of traffic. By employing deep learning models to model mining traffic, global features within the mining traffic are extracted to enhance the accuracy of mining traffic detection. The traffic classification model proposed in the article first employed a Transformer encoder to extract global features of the traffic, followed by a sequence summarizer to process the encoded results, obtaining a fixed-length representation for classification. Due to the mining samples accounting for less than 3% in the dataset, using accuracy to measure the classification effect of the model leads to significant bias. Therefore, the article comprehensively considered the precision and recall of the model, and employed the F1 score to evaluate the classification performance. Utilizing sinusoidal positional encoding in the model’s encoder enables the model to achieve an F1 score of 99.84% on the test set, with a precision rate of 100%.

Key words: mining malware, traffic classification, deep learning, sequence processing