# DeepMAL -- Deep Learning Models for Malware Traffic Detection and Classification

arXiv: https://arxiv.org/abs/2003.04079 · HTML: https://mlsanity.com/paper/2003.04079/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Mar 2020.

## Built on by (most cited first, 8 of 8)

- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [DNN-ForwardTesting: A New Trading Strategy Validation using Statistical Timeseries Analysis and Deep Neural Networks](https://mlsanity.com/paper/2210.11532/) (2022)
- [Detecting Attacks on IoT Devices using Featureless 1D-CNN](https://mlsanity.com/paper/2109.03989/) (2021)
- [SeqNet: An Efficient Neural Network for Automatic Malware Detection](https://mlsanity.com/paper/2205.03850/) (2022)
- [Open-Source Framework for Encrypted Internet and Malicious Traffic Classification](https://mlsanity.com/paper/2206.10144/) (2022)
- [Efficient Attack Detection in IoT Devices using Feature Engineering-Less Machine Learning](https://mlsanity.com/paper/2301.03532/) (2023)
- [CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution](https://mlsanity.com/paper/2403.11206/) (2024)
- [Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques](https://mlsanity.com/paper/2407.16539/) (2024)

## Abstract (arXiv)

Robust network security systems are essential to prevent and mitigate the harming effects of the ever-growing occurrence of network attacks. In recent years, machine learning-based systems have gain popularity for network security applications, usually considering the application of shallow models, which rely on the careful engineering of expert, handcrafted input features. The main limitation of this approach is that handcrafted features can fail to perform well under different scenarios and types of attacks. Deep Learning (DL) models can solve this limitation using their ability to learn feature representations from raw, non-processed data. In this paper we explore the power of DL models on the specific problem of detection and classification of malware network traffic. As a major advantage with respect to the state of the art, we consider raw measurements coming directly from the stream of monitored bytes as input to the proposed models, and evaluate different raw-traffic feature representations, including packet and flow-level ones. We introduce DeepMAL, a DL model which is able to capture the underlying statistics of malicious traffic, without any sort of expert handcrafted features. Using publicly available traffic traces containing different families of malware traffic, we show that DeepMAL can detect and classify malware flows with high accuracy, outperforming traditional, shallow-like models.