# Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic

arXiv: https://arxiv.org/abs/2309.04798 · HTML: https://mlsanity.com/paper/2309.04798/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Sep 2023.

## Built on by (most cited first, 12 of 12)

- [Robust and Reliable Early-Stage Website Fingerprinting Attacks via Spatial-Temporal Distribution Analysis](https://mlsanity.com/paper/2407.00918/) (2024)
- [Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed](https://mlsanity.com/paper/2403.11090/) (2024)
- [Generative Active Adaptation for Drifting and Imbalanced Network Intrusion Detection](https://mlsanity.com/paper/2503.03022/) (2025)
- [Towards Fine-Grained Webpage Fingerprinting at Scale](https://mlsanity.com/paper/2409.04341/) (2024)
- [UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security](https://mlsanity.com/paper/2503.04174/) (2025)
- [NOS-Gate: Queue-Aware Streaming IDS for Consumer Gateways under Timing-Controlled Evasion](https://mlsanity.com/paper/2601.00389/) (2026)
- [SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks](https://mlsanity.com/paper/2609.02140/) (2026)
- [ETGuard: Malicious Encrypted Traffic Detection in Blockchain-based Power Grid Systems](https://mlsanity.com/paper/2408.10657/) (2024)
- [Hierarchical Local-Global Feature Learning for Few-shot Malicious Traffic Detection](https://mlsanity.com/paper/2504.03742/) (2025)
- [Packet-Level DDoS Data Augmentation Using Dual-Stream Temporal-Field Diffusion](https://mlsanity.com/paper/2507.20115/) (2025)
- [BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows](https://mlsanity.com/paper/2608.14126/) (2026)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

Machine learning (ML) is promising in accurately detecting malicious flows in encrypted network traffic; however, it is challenging to collect a training dataset that contains a sufficient amount of encrypted malicious data with correct labels. When ML models are trained with low-quality training data, they suffer degraded performance. In this paper, we aim at addressing a real-world low-quality training dataset problem, namely, detecting encrypted malicious traffic generated by continuously evolving malware. We develop RAPIER that fully utilizes different distributions of normal and malicious traffic data in the feature space, where normal data is tightly distributed in a certain area and the malicious data is scattered over the entire feature space to augment training data for model training. RAPIER includes two pre-processing modules to convert traffic into feature vectors and correct label noises. We evaluate our system on two public datasets and one combined dataset. With 1000 samples and 45% noises from each dataset, our system achieves the F1 scores of 0.770, 0.776, and 0.855, respectively, achieving average improvements of 352.6%, 284.3%, and 214.9% over the existing methods, respectively. Furthermore, We evaluate RAPIER with a real-world dataset obtained from a security enterprise. RAPIER effectively achieves encrypted malicious traffic detection with the best F1 score of 0.773 and improves the F1 score of existing methods by an average of 272.5%.