# When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification

arXiv: https://arxiv.org/abs/2206.08004 · HTML: https://mlsanity.com/paper/2206.08004/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 59 references that are in the map.
- First posted on arXiv 16 Jun 2022.

## Builds on (most cited first, 13 of 13)

- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [Deep Learning for Encrypted Traffic Classification: An Overview](https://mlsanity.com/paper/1810.07906/) (2018)
- [Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis](https://mlsanity.com/paper/2106.14707/) (2021)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification](https://mlsanity.com/paper/2103.03939/) (2021)
- [Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications](https://mlsanity.com/paper/2104.03182/) (2021)
- [Peek-a-Boo: I see your smart home activities, even encrypted!](https://mlsanity.com/paper/1808.02741/) (2018)
- [DeepMAL -- Deep Learning Models for Malware Traffic Detection and Classification](https://mlsanity.com/paper/2003.04079/) (2020)
- [CGNN: Traffic Classification with Graph Neural Network](https://mlsanity.com/paper/2110.09726/) (2021)
- [Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study](https://mlsanity.com/paper/2203.09332/) (2022)
- [NetML: A Challenge for Network Traffic Analytics](https://mlsanity.com/paper/2004.13006/) (2020)
- [Robust Machine Learning for Encrypted Traffic Classification](https://mlsanity.com/paper/1603.04865/) (2016)

## Built on by (most cited first, 5 of 5)

- [LLMcap: Large Language Model for Unsupervised PCAP Failure Detection](https://mlsanity.com/paper/2407.06085/) (2024)
- [Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms](https://mlsanity.com/paper/2304.03691/) (2023)
- [CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution](https://mlsanity.com/paper/2403.11206/) (2024)
- [PCAPVision: PCAP-Based High-Velocity and Large-Volume Network Failure Detection](https://mlsanity.com/paper/2407.11021/) (2024)
- [BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows](https://mlsanity.com/paper/2608.14126/) (2026)

## Abstract (arXiv)

Internet traffic classification is widely used to facilitate network management. It plays a crucial role in Quality of Services (QoS), Quality of Experience (QoE), network visibility, intrusion detection, and traffic trend analyses. While there is no theoretical guarantee that deep learning (DL)-based solutions perform better than classic machine learning (ML)-based ones, DL-based models have become the common default. This paper compares well-known DL-based and ML-based models and shows that in the case of malicious traffic classification, state-of-the-art DL-based solutions do not necessarily outperform the classical ML-based ones. We exemplify this finding using two well-known datasets for a varied set of tasks, such as: malware detection, malware family classification, detection of zero-day attacks, and classification of an iteratively growing dataset. Note that, it is not feasible to evaluate all possible models to make a concrete statement, thus, the above finding is not a recommendation to avoid DL-based models, but rather empirical proof that in some cases, there are more simplistic solutions, that may perform even better.