# BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows

arXiv: https://arxiv.org/abs/2608.14126 · HTML: https://mlsanity.com/paper/2608.14126/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 44 references that are in the map.
- First posted on arXiv 14 Aug 2026.

## Builds on (most cited first, 11 of 11)

- [TinyBERT: Distilling BERT for Natural Language Understanding](https://mlsanity.com/paper/1909.10351/) (2019)
- [A Survey on Visual Transformer](https://mlsanity.com/paper/2012.12556/) (2020)
- [Eagle and Finch: RWKV with Matrix-Valued States and Dynamic Recurrence](https://mlsanity.com/paper/2404.05892/) (2024)
- [A Systematic Survey of Regularization and Normalization in GANs](https://mlsanity.com/paper/2008.08930/) (2020)
- [Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic](https://mlsanity.com/paper/2309.04798/) (2023)
- [Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis](https://mlsanity.com/paper/2301.13686/) (2023)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Identifying Relevant Features of CSE-CIC-IDS2018 Dataset for the Development of an Intrusion Detection System](https://mlsanity.com/paper/2307.11544/) (2023)
- [Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms](https://mlsanity.com/paper/2304.03691/) (2023)
- [Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective](https://mlsanity.com/paper/2403.15672/) (2024)
- [DecETT: Accurate App Fingerprinting Under Encrypted Tunnels via Dual Decouple-based Semantic Enhancement](https://mlsanity.com/paper/2504.15565/) (2025)

## Abstract (arXiv)

To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance (ANOVA) to decouple high-discriminatory control-plane features - specifically industrial setpoints - from stochastic cryptographic noise. To resolve the extreme class imbalance within a corpus of 86,878 flow records, a Wasserstein GAN with Gradient Penalty (WGAN-GP) module, enforcing the 1-Lipschitz constraint, is integrated to synthesize high-fidelity minority samples, elevating the detection recall of rare Malicious State Command Injections(MSCI) attacks by 43.2%. At its core, the BGA architecture integrates Bidirectional Long Short-Term Memory (BiLSTM) for temporal dependency extraction and an Adaptive Gated Multi-Head Attention mechanism. This gated unit functions as a neural filter to dynamically suppress encryption artifacts while amplifying malicious signatures. Extensive evaluations on CIC-IDS-2018 and Edge-IIoT benchmarks demonstrate a performance ceiling exceeding 95.2% across all key metrics. Furthermore, noise-injection stress tests confirm BGAs superior structural resilience with a 8.57% performance margin over vanilla Transformers, while its ultra-low inference latency of 0.2820 ms (estimated 1.6920 ms via theoretical scaling for ARM) indicates a high potential for real-time feasibility on heterogeneous industrial edge gateways, providing a promising architectural baseline for future hardware implementation.