# Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis

arXiv: https://arxiv.org/abs/2106.14707 · HTML: https://mlsanity.com/paper/2106.14707/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 85 references that are in the map.
- First posted on arXiv 28 Jun 2021.

## Builds on (most cited first, 12 of 12)

- [Deep Speech 2: End-to-End Speech Recognition in English and Mandarin](https://mlsanity.com/paper/1512.02595/) (2015)
- [Deep Speech: Scaling up end-to-end speech recognition](https://mlsanity.com/paper/1412.5567/) (2014)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [A4NT: Author Attribute Anonymity by Adversarial Training of Neural Machine Translation](https://mlsanity.com/paper/1711.01921/) (2017)
- [Automated Website Fingerprinting through Deep Learning](https://mlsanity.com/paper/1708.06376/) (2017)
- [LOBO -- Evaluation of Generalization Deficiencies in Twitter Bot Classifiers](https://mlsanity.com/paper/1809.09684/) (2018)
- [Network Traffic Anomaly Detection Using Recurrent Neural Networks](https://mlsanity.com/paper/1803.10769/) (2018)
- [You Do (Not) Belong Here: Detecting DPI Evasion Attacks with Context Learning](https://mlsanity.com/paper/2011.01514/) (2020)
- [Encrypted DNS --> Privacy? A Traffic Analysis Perspective](https://mlsanity.com/paper/1906.09682/) (2019)
- [Practical Traffic Analysis Attacks on Secure Messaging Applications](https://mlsanity.com/paper/2005.00508/) (2020)
- [Vesper: Using Echo-Analysis to Detect Man-in-the-Middle Attacks in LANs](https://mlsanity.com/paper/1803.02560/) (2018)
- [Off-Path TCP Exploits of the Mixed IPID Assignment](https://mlsanity.com/paper/2008.12981/) (2020)

## Built on by (most cited first, 20 of 20)

- [Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems](https://mlsanity.com/paper/2401.05778/) (2024)
- [NetGPT: Generative Pretrained Transformer for Network Traffic](https://mlsanity.com/paper/2304.09513/) (2023)
- [NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba](https://mlsanity.com/paper/2405.11449/) (2024)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency](https://mlsanity.com/paper/2205.09669/) (2022)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed](https://mlsanity.com/paper/2403.11090/) (2024)
- [An Intrusion Detection System based on Deep Belief Networks](https://mlsanity.com/paper/2207.02117/) (2022)
- [Generative Active Adaptation for Drifting and Imbalanced Network Intrusion Detection](https://mlsanity.com/paper/2503.03022/) (2025)
- [Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification](https://mlsanity.com/paper/2505.20866/) (2025)
- [Deep Learning-based Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2504.07839/) (2025)
- [UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security](https://mlsanity.com/paper/2503.04174/) (2025)
- [NetMamba+: A Framework of Pre-trained Models for Efficient and Accurate Network Traffic Classification](https://mlsanity.com/paper/2601.21792/) (2026)
- [UniAlign: A Model-Agnostic Framework for Robust Network Traffic Classification under Distribution Shifts](https://mlsanity.com/paper/2605.17575/) (2026)
- [ETGuard: Malicious Encrypted Traffic Detection in Blockchain-based Power Grid Systems](https://mlsanity.com/paper/2408.10657/) (2024)
- [LogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis](https://mlsanity.com/paper/2410.21936/) (2024)
- [Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC](https://mlsanity.com/paper/2508.02001/) (2025)
- [REFN: A Reinforcement-Learning-From-Network Framework against 1-day/n-day Exploitations](https://mlsanity.com/paper/2508.10701/) (2025)
- [A Modular Framework for Rapidly Building Intrusion Predictors](https://mlsanity.com/paper/2511.23000/) (2025)
- [MalMoE: Mixture-of-Experts Enhanced Encrypted Malicious Traffic Detection Under Graph Drift](https://mlsanity.com/paper/2602.10157/) (2026)

## Abstract (arXiv)

Machine learning (ML) based malicious traffic detection is an emerging security paradigm, particularly for zero-day attack detection, which is complementary to existing rule based detection. However, the existing ML based detection has low detection accuracy and low throughput incurred by inefficient traffic features extraction. Thus, they cannot detect attacks in realtime especially in high throughput networks. Particularly, these detection systems similar to the existing rule based detection can be easily evaded by sophisticated attacks. To this end, we propose Whisper, a realtime ML based malicious traffic detection system that achieves both high accuracy and high throughput by utilizing frequency domain features. It utilizes sequential features represented by the frequency domain features to achieve bounded information loss, which ensures high detection accuracy, and meanwhile constrains the scale of features to achieve high detection throughput. Particularly, attackers cannot easily interfere with the frequency domain features and thus Whisper is robust against various evasion attacks. Our experiments with 42 types of attacks demonstrate that, compared with the state-of-theart systems, Whisper can accurately detect various sophisticated and stealthy attacks, achieving at most 18.36% improvement, while achieving two orders of magnitude throughput. Even under various evasion attacks, Whisper is still able to maintain around 90% detection accuracy.