A two-dimensional convolutional gated recurrent unit based method for classifying malicious encrypted traffic

With the development of traffic encryption technology, more and more malicious traffic adopts encryption technology to hide their activities. To address the problems of existing deep learning models such as low training efficiency and poor real-time classification due to deeper hierarchy, this paper proposes a malicious encrypted traffic classification method based on Two-Dimensional Convolution Gate Recurrent Unit (TDCGRU). Firstly, the spatial features of individual packets are extracted using two-dimensional convolution; then the time series features between packets at the traffic level are extracted using the gated recurrent unit, so that the spatio-temporal features are extracted at the packet level and the flow level of the traffic respectively. Based on the public datasets CTU-13 and CICAndMal2017, the experimental results show that the accuracy of the method in this paper reaches 99.2%, and compared with the BGRUA model, the classification delay and training time are saved by 11.2% and 12%, respectively, while improving the classification effect.