A Few-Shot Malware Traffic Classification Method Using Knowledge Transfer Learning

Malware traffic classification (MTC) has become one of the important tasks to protect network and system security. However, it is a difficult task to obtain large-scale labeled malware traffic data in practice due to the wide variety and ever-changing malware. Existing MTC techniques require a large number of samples for training, the classification performance is poor when the training samples are few. Therefore, classification techniques based on few-shot learning (FSL) have attracted much attention in MTC. In this paper, we propose a few-shot MTC method based on knowledge transfer learning. Specifically, generic malware feature representation can be learned by pre-training the deep learning model on source tasks. Then, the parameters of the pre-trained model are used as initial parameters to fine-tune on the target task to adapt to feature distribution of the target task. The simulation results show that the few-shot MTC method based on knowledge transfer learning proposed in this paper has a 20-shot average accuracy of 95.23% when using GoogLeNet network as the backbone network, compared with CNN, VGG, and ResNet models, GoogLeNet has the best performance.