Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis. (arXiv:2301.13686v1 [cs.CR])

In this paper, we propose HyperVision, a realtime unsupervised machine
learning (ML) based malicious traffic detection system. Particularly,
HyperVision is able to detect unknown patterns of encrypted malicious traffic
by utilizing a compact inmemory graph built upon the traffic patterns. The
graph captures flow interaction patterns represented by the graph structural
features, instead of the features of specific known attacks. We develop an
unsupervised graph learning method to detect abnormal interaction patterns by
analyzing the connectivity, sparsity, and statistical features …

analysis attacks detect detection encrypted features flow machine machine learning malicious patterns real time system traffic