# Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study

arXiv: https://arxiv.org/abs/2203.09332 · HTML: https://mlsanity.com/paper/2203.09332/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 87 references that are in the map.
- First posted on arXiv 17 Mar 2022.

## Builds on (most cited first, 7 of 7)

- [Deep Learning in Mobile and Wireless Networking: A Survey](https://mlsanity.com/paper/1803.04311/) (2018)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [Deciphering Malware's use of TLS (without Decryption)](https://mlsanity.com/paper/1607.01639/) (2016)
- [Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks](https://mlsanity.com/paper/1909.00104/) (2019)
- [The Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis](https://mlsanity.com/paper/1708.03766/) (2017)

## Built on by (most cited first, 6 of 6)

- [Enhancing Few-Shot Learning with Integrated Data and GAN Model Approaches](https://mlsanity.com/paper/2411.16567/) (2024)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Energy-Efficient Deep Learning for Traffic Classification on Microcontrollers](https://mlsanity.com/paper/2506.10851/) (2025)
- [Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms](https://mlsanity.com/paper/2304.03691/) (2023)
- [Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT](https://mlsanity.com/paper/2602.16098/) (2026)
- [PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification](https://mlsanity.com/paper/2608.15504/) (2026)

## Abstract (arXiv)

As people's demand for personal privacy and data security becomes a priority, encrypted traffic has become mainstream in the cyber world. However, traffic encryption is also shielding malicious and illegal traffic introduced by adversaries, from being detected. This is especially so in the post-COVID-19 environment where malicious traffic encryption is growing rapidly. Common security solutions that rely on plain payload content analysis such as deep packet inspection are rendered useless. Thus, machine learning based approaches have become an important direction for encrypted malicious traffic detection. In this paper, we formulate a universal framework of machine learning based encrypted malicious traffic detection techniques and provided a systematic review. Furthermore, current research adopts different datasets to train their models due to the lack of well-recognized datasets and feature sets. As a result, their model performance cannot be compared and analyzed reliably. Therefore, in this paper, we analyse, process and combine datasets from 5 different sources to generate a comprehensive and fair dataset to aid future research in this field. On this basis, we also implement and compare 10 encrypted malicious traffic detection algorithms. We then discuss challenges and propose future directions of research.