Integrating Explainable AI for Effective Malware Detection in Encrypted Network Traffic

Amsalu Fentie Jember; Mario Bochicchio; Sileshi Nibret Zeleke

REVIEW 6 major objections 6 minor 2 cited by

Integrating Explainable AI for Effective Malware Detection in Encrypted Network Traffic

T0 review · 6 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A tree-ensemble model trained on connection metadata can detect malware in encrypted traffic at over 99% accuracy without decrypting payloads, and SHAP explanations show which features drive each decision.

desk verdict The paper's >99% metrics are very likely an artifact of ADASYN oversampling before cross-validation; the SHAP analysis is clean but the evaluation is not sound. read the letter →

arxiv 2501.05387 v1 pith:5ULJ4R6L submitted 2025-01-09 cs.CR cs.LG

Sileshi Nibret Zeleke , Amsalu Fentie Jember , Mario Bochicchio This is my paper · ORCID

classification cs.CRcs.LG

keywords encryptedtrafficmalwaredetectionexplainableAISHAPXGBoostensemblelearningnetworksecurityCTU-13

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that malware hiding inside encrypted network connections can be detected without decryption by training tree-ensemble classifiers on metadata that describes how the connection behaves, not what it carries. It reports that XGBoost identifies malicious traffic with above 99% accuracy, precision, and F1-score on its own collection of 1,127 malicious flows spanning 54 families, and above 99% on the CTU-13 benchmark. What makes the approach explainable is the use of SHAP to show which features drive each decision: maximum packet size, mean inter-arrival time, and the TLS version dominate the global explanation. If those numbers hold, security analysts could get reliable encrypted-malware alerts with reasons attached, without breaking encryption.

What carries the argument

The load-bearing machinery is the pairing of a multi-view feature representation of encrypted flows with a tree-ensemble classifier and Shapley-value attribution. The feature representation is what lets the model see malicious behavior without payload access: it includes handshake details such as offered and accepted cipher suites, TLS extensions and version numbers, certificate validity, time and packet-length statistics, connection metadata, and a 3x3 Markov-chain transition matrix whose states are fixed 150-byte-per-millisecond bins for packet size and inter-arrival time. The classifier side is a set of bagged and boosted trees, namely random forest, XGBoost, and extra trees, with XGBoost reported as best. The explanation side is SHAP, Shapley Additive Explanations, an additive feature-attribution method from cooperative game theory, applied through a tree-specific explainer that decomposes each prediction into additive per-feature contributions, both globally and locally.

What would settle it

Re-run the XGBoost pipeline with the adaptive oversampling applied only within each training fold, and also with no oversampling at all, then compare accuracy, precision, and F1-score; if the scores drop well below 99%, the original numbers are partly an artifact of data leakage. A simpler check is to inspect the preprocessing code to see whether any synthetic sample generated from a test-set connection appears in a training set.

Watch

Extended reading notes

Core claim

In the paper's own framing, the central discovery is that the behavior of encrypted malware is visible in side-channel features of the TLS connection itself, and tree ensembles can exploit that signal nearly perfectly. The authors build each flow from a 5-tuple bidirectional conversation, filter to completed handshakes, and extract features across handshake offers and accepted ciphers, TLS extensions and versions, certificate validity days, packet length and inter-arrival-time statistics, connection byte and packet counters, and a 3x3 Markov transition matrix built from 150-byte-per-millisecond states. On this representation, XGBoost achieves 99.32% accuracy, 99.53% precision, and 99.43% F1-score on the author-collected dataset and over 99% on CTU-13. The paper also claims that global SHAP explanations consistently rank maximum packet size, mean inter-arrival time of packets, and TLS version as the most influential signals, and that local force plots explain individual traffic samples.

Load-bearing premise

The reported near-perfect accuracy depends on the balancing step not letting any test-set information reach the training data; the paper does not state whether the synthetic oversampling is performed inside each cross-validation fold, and if it is not, the 99% figures would be inflated.

Editorial extensions

If this is right

If the near-perfect metrics are leak-free, the pipeline gives a practical way to alert on encrypted malware without decrypting any payload.
The global SHAP ranking gives security analysts three concrete, prioritized signals to monitor: maximum packet size, mean packet inter-arrival time, and TLS version.
Local force plots turn each alert into an explanation an analyst can inspect, a step toward trustable automated triage.
The author-collected dataset, 1,127 malicious flows across 54 families, becomes a public benchmark for future explainable-detection work.
The strong performance on CTU-13 suggests the features transfer beyond the specific malware families used for training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the reported numbers are leak-free, the same pipeline could seed lightweight in-network detectors that fire on packet-size and timing statistics before any machine-learning model runs; the paper does not itself propose such a detector.
A fair re-evaluation should nest the adaptive oversampling inside each cross-validation fold and also try simpler models, because the reported best hyperparameters, such as a tree depth of 43 with only 23 estimators, are typical of overfitting rather than of a discovery about encrypted traffic.
The paper does not test zero-day malware; whether the features generalize to unseen families is a natural next experiment, and the local explanations would be the way to audit failures.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Bottom line: the paper’s headline numbers — 99%+ accuracy on both datasets — are very likely inflated by a data leakage mistake. Section 3.6 says the normal class is oversampled with ADASYN and then the model is trained with 10-fold CV, but it never states that oversampling is done inside each fold. With a 98.97/1.03 class split, doing ADASYN globally means synthetic instances derived from test-fold data leak into training folds. The paper gives no code, no dataset, and no explicit ordering, so the results are not reproducible under a sound protocol. That makes the central claim unsupported as written.

Credit where it is due: the authors assembled a malware corpus from several public sources covering 54 families — that takes real effort — and they report MCC alongside accuracy, which is better than many papers in this area. The SHAP global and local explanation analysis is presented cleanly, and benchmarking on CTU-13, if the protocol were fixed, would be a useful sanity check. The related work is adequate and the paper cites its own prior ensemble-learning work, which is not a problem by itself.

The soft spots beyond the leak: no baseline comparison on the same data. Section 4.4 compares against one published accuracy number, but the models are not re-run under the same conditions. Equation 1 is not a correct formula for random forest. Algorithm 1’s flow-window logic is hard to follow. Hyperparameters like max_depth=43 for XGB on 1,127 samples are extreme and consistent with memorization or leakage. The explanation findings are post hoc — SHAP describes the fitted model, not an external ground truth, and the paper overstates them as insights into malware behavior.

The paper is for a reader who wants a worked example of SHAP on encrypted traffic, but those readers should not trust the reported metrics. The dataset would be a contribution if released, but it is not. This deserves a serious referee only in the sense that the evaluation could be repaired; as written, I would not accept it. My recommendation: send it back for major revision with a mandatory request to redo the whole evaluation with oversampling inside CV and to release code and data. If that cannot be done, reject.

Referee Report

6 major / 6 minor

Summary. The paper proposes an explainable malware-detection pipeline for encrypted network traffic. It constructs bidirectional flows from raw pcap data, extracts multi-view features (handshake metadata, certificate fields, timing and packet-length statistics, Markov-chain-derived states, and connection metadata), trains three tree-ensemble classifiers (Random Forest, XGBoost, Extra Trees), and applies SHAP TreeExplainer for global and local explanations. The authors report near-perfect performance on a self-compiled dataset of 1,127 malicious captures spanning 54 families, and on the CTU-13 dataset, with XGBoost achieving 99.32% accuracy, 99.53% precision, and 99.43% F1-score on the custom dataset. They also claim a dataset contribution and identify maximum packet size, mean inter-arrival time, and TLS version as the most critical features.

Significance. If the evaluation protocol were sound, the paper would be a useful empirical contribution to encrypted-traffic malware detection and XAI: it combines multi-view feature extraction, tree ensembles, a CTU-13 benchmark, MCC reporting, and SHAP-based explanations, and it attempts to assemble a multi-family malware capture set. The main strengths are the breadth of feature families and the use of a public benchmark dataset. However, the headline claims are currently not credible because the relationship between oversampling, hyperparameter selection, and cross-validation is not specified, no same-data baselines are provided, and the self-compiled dataset mixes traffic from different sources in ways that may introduce confounds. The SHAP findings are also presented with causal language that the method does not support. With a corrected evaluation protocol and additional baselines, the central idea could be salvageable, but the present version does not substantiate its central quantitative claims.

major comments (6)

[Section 3.6] The ADASYN oversampling procedure is not described as nested inside the cross-validation folds. The text states that "we oversample our normal samples using an adaptive synthetic sampling technique" and then "We train the model based on 10-fold cross-validation," but it never states that oversampling is applied independently to each training fold. Because the dataset is 98.97% normal and 1.03% malicious, ADASYN generates synthetic samples from nearest neighbors computed over the whole dataset; if this is done before splitting, synthetic instances derived from test-fold observations leak into the training folds. This would directly inflate the reported 99% accuracy, precision, and F1 metrics in Section 4.1. The authors must rerun the experiments with oversampling performed only inside each training fold, or use a pipeline that makes the ordering explicit, and report both results.
[Section 3.6] Hyperparameter selection is also not described as nested within the cross-validation procedure. The RF parameters are chosen from "validation curves" and the XGB parameters from a "nature-inspired genetic algorithm," but the paper does not state whether these searches are performed inside each fold or on the full dataset. If the hyperparameters are tuned on the full dataset before cross-validation, the reported metrics are optimistically biased. The XGBoost setting max_depth=43 on a dataset of 1,127 samples is particularly concerning and is consistent with memorization rather than generalization. The authors should either use nested cross-validation or fixed, conservatively chosen hyperparameters and report the associated performance.
[Section 4.4] The comparison with existing work is not conducted on the same data or protocol. Section 4.4 cites a single literature accuracy of 96.71% from [34] and states that "Our system outperforms," but no baseline model is trained or evaluated on the custom dataset or on the same CTU-13 split. Different datasets, feature sets, and evaluation protocols make this comparison uninformative. The central claim of superior performance needs same-data baselines, at minimum standard classifiers such as logistic regression or a simple neural network, and ideally prior encrypted-malware-detection methods re-run under the same evaluation pipeline.
[Sections 3.1 and 4.1] The self-compiled dataset has a likely source-domain confound. Malicious traffic was collected from six different public repositories, while normal traffic was collected from the Addis Ababa Science and Technology campus network and from CTU-13. A classifier may therefore separate traffic by collection environment, capture time, or IP/TLS fingerprint rather than by maliciousness. The paper provides no per-source evaluation, no domain-adaptation analysis, and no check of whether the same features separate normal and malicious traffic within each source. This threatens both the detection claims and the SHAP-based feature-importance conclusions. The authors should evaluate with held-out sources or include a per-source breakdown.
[Abstract and Sections 3.2/3.6] The abstract claims the compiled dataset has "1,127 unique connections, more than any other available open-source dataset," but Section 3.2 states that the CTU-13 dataset alone contains 38,898 botnet samples and 53,314 normal samples. This is internally inconsistent and the dataset-size claim is factually incorrect. The claim should be removed or replaced with an accurate statement about the number of malware families or the availability of labeled malicious captures.
[Sections 4.2 and 4.3] The SHAP global explanations are descriptive properties of the fitted model, but the discussion interprets them as causal or behavioral facts about malware. For example, Section 4.3 states that "malware traffic is characterized by a higher volume of packets" and that "malware authors tend to prefer older TLS versions." These conclusions are not established by SHAP values alone, since SHAP summarizes the model's decision function rather than ground-truth malware behavior. To support such claims, the authors should either validate the features through ablation experiments or rephrase the statements as observations about the trained model.

minor comments (6)

[Section 2] There is a grammatical error in the sentence "By observing the disparities between malicious and normal network flow's contextual information were can capture strong discriminatory feature set"; it should be "we can capture." Similar language issues appear elsewhere and should be corrected in a thorough copyedit.
[Section 4.2] The description of the SHAP summary plot colors is inaccurate: the text says "blue indicating positive influences and red indicating negative ones," but in a standard SHAP summary plot the color bar encodes feature values (high versus low), not the direction of the Shapley value. Please clarify the color semantics.
[Section 4.2] The local explanation text is hard to follow: "The explanation of an expected feature that affects the target class centers on the plot around the x-axis" and "was 4.97, which is higher than the base value" lack a clear subject and would benefit from rewriting.
[Section 3.3] Equation (1) for Random Forest is nonstandard and its variables are not fully defined; in particular, the meaning of W_i(x_j,z) and the summation limits are unclear. Please replace it with a standard description or a proper reference.
[Section 3.6] The phrase "we oversample our normal samples" appears to contradict the goal of balancing the dataset, since normal samples are the majority class (98.97%). Please clarify whether the minority or majority class was oversampled, and how the "balanced" dataset in Figure 2(b) was constructed.
[Section 3.1 and Conclusion] The paper states the dataset is "presented for the research community," but no download link, repository, or data availability statement is given. Please add an availability statement or remove the claim.

Circularity Check

1 steps flagged · score 6.0 of 10

The custom-dataset >99% detection result is not an independent prediction as described: ADASYN oversampling is specified before 10-fold CV, so test-fold information can enter training by construction.

fitted input called prediction [Section 3.6 'Experimental Settings'; reported in Section 4.1 (Figs 2-3) and Abstract]
"Moreover, To simulate the real-world scenario of malicious traffic occurrences in any given communication environment, we oversample our normal samples using an adaptive synthetic sampling technique. The normal-to-malware proportion of the imbalanced dataset is 98.97% to 1.03%. ... We train the model based on 10-fold cross-validation."

The paper never states that ADASYN is fitted independently inside each training fold. As written, oversampling is a global pre-CV step. ADASYN generates synthetic samples using nearest neighbors in the full feature space, so synthetic instances derived from samples that later land in held-out test folds can appear in the training folds. The test-fold accuracy/F1 (99.32%/99.43% on the custom dataset) is then not an out-of-sample prediction: the model has effectively seen test-derived feature information during training, so the reported detection performance is inflated by construction rather than measuring generalization. This is a fitted-input-evaluated-as-prediction reduction.

full rationale

The paper is an empirical ML study rather than a mathematical derivation, so most of its chain is not circular: XGB/RF/ExtraTrees are fitted to features, and SHAP explanations are post-hoc descriptions of the fitted model, not independent predictions. The minor self-citation ([18], used to motivate tree ensembles) is not load-bearing. The one load-bearing circular reduction is the evaluation protocol: Section 3.6 places ADASYN oversampling before the 10-fold CV split and gives no indication that oversampling is nested inside folds. Because ADASYN synthesizes points from nearest neighbors over the whole dataset, a global application makes the held-out folds informative for training, so the headline custom-dataset metrics are not independent. The CTU-13 benchmark (also >99%) may be less affected if no oversampling was applied to it, which prevents a score of 8-10, but the abstract's central claim about the custom dataset is partially a construction of the leaky preprocessing rather than a validated prediction.

Assumptions & free parameters 13 free parameters · 5 assumptions · 0 invented entities

The paper's central claim rests on assumptions about dataset representativeness, feature validity, and the underspecified oversampling protocol. No free parameters beyond the fitted hyperparameters are introduced; no new entities are postulated.

free parameters (13)

RF n_estimators = 23
Tuned via validation curve on the target dataset (Section 3.6).
RF max_depth = 42
Tuned via validation curve on the target dataset (Section 3.6).
RF min_samples_split = 6
Tuned via validation curve on the target dataset (Section 3.6).
RF min_samples_leaf = 2
Tuned via validation curve on the target dataset (Section 3.6).
XGB n_estimators = 23
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB max_depth = 43
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB learning_rate = 0.47
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB min_child_weight = 0.4
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB gamma = 3.28
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB colsample = 1
Tuned via genetic algorithm on the target dataset (Section 3.6).
XGB subsample = 0.82
Tuned via genetic algorithm on the target dataset (Section 3.6).
Markov chain bin size = 150 bytes/ms per state
Chosen ad hoc in Algorithm 1 (Section 3.2).
Flow window duration = 30 minutes
Chosen in Algorithm 1 (Section 3.2).

assumptions (5)

domain assumption The collected malware samples represent the diversity of encrypted malware in the wild.
The dataset includes 54 families but is highly imbalanced and collected from only six sources (Section 3.1).
domain assumption Flow construction via Joy and the selected features capture behavior relevant to malware detection.
The paper relies on Joy's flow output without validating feature quality (Section 3.2).
ad hoc to paper Discretization of time and packet size into 3 states with 150-byte/ms bins preserves discriminative information.
No analysis justifies this bin size or the number of states (Algorithm 1).
domain assumption Normal traffic from campus network is representative of benign encrypted traffic.
Self-collected traffic from one campus may not match the distribution of internet traffic (Section 3.1).
domain assumption The ADASYN oversampling does not leak test information into the training set.
The paper does not specify whether oversampling is nested in cross-validation (Section 3.6).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Integrating Explainable AI for Effective Malware Detection in Encrypted Network Traffic." pith.science (2026). https://pith.science/paper/5ULJ4R6L

@misc{pith2026250105387,
  author       = {Pith},
  title        = {Pith review of: Integrating Explainable AI for Effective Malware Detection in Encrypted Network Traffic},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5ULJ4R6L}},
  note         = {Machine review of arXiv:2501.05387}
}

read the original abstract

Encrypted network communication ensures confidentiality, integrity, and privacy between endpoints. However, attackers are increasingly exploiting encryption to conceal malicious behavior. Detecting unknown encrypted malicious traffic without decrypting the payloads remains a significant challenge. In this study, we investigate the integration of explainable artificial intelligence (XAI) techniques to detect malicious network traffic. We employ ensemble learning models to identify malicious activity using multi-view features extracted from various aspects of encrypted communication. To effectively represent malicious communication, we compiled a robust dataset with 1,127 unique connections, more than any other available open-source dataset, and spanning 54 malware families. Our models were benchmarked against the CTU-13 dataset, achieving performance of over 99% accuracy, precision, and F1-score. Additionally, the eXtreme Gradient Boosting (XGB) model demonstrated 99.32% accuracy, 99.53% precision, and 99.43% F1-score on our custom dataset. By leveraging Shapley Additive Explanations (SHAP), we identified that the maximum packet size, mean inter-arrival time of packets, and transport layer security version used are the most critical features for the global model explanation. Furthermore, key features were identified as important for local explanations across both datasets for individual traffic samples. These insights provide a deeper understanding of the model decision-making process, enhancing the transparency and reliability of detecting malicious encrypted traffic.

Figures

Figures reproduced from arXiv: 2501.05387 by the authors.

**Figure 1.** Overview of the proposed explainable malware detection pipeline imbalanced, as all malware families represent a single class (i.e., the malware class). Acquiring normal traffic captured in a local area network (LAN) setup at the enterprise network edge or host is relatively straightforward compared to obtaining malware traffic. In our study, we utilized two sources for normal traffic data: self-collected traffic fr… view at source ↗

**Figure 2.** Radar plot for performance comparison of the proposed malware detection across different datasets and metrics: (a) CTU-13; (b) Our dataset; (c) Our imbalanced dataset The confusion matrix in [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

**Figure 3.** Confusion matrix comparison on: (a) CTU-13; (b) Our imbalanced dataset 4.2 Explaining Detection Model Visualizing the best-performing model’s decision-making process using XAI techniques helps to identify malicious behavior and understanding such a decision is crucial for cyber-analytics. An insight into the decision helps administrators identify the part of the network, part of the features, the security policies … view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Summary plot of global explanation of XGBoost model trained using our dataset In normal traffic, the standard deviation of the byte inter-arrival time between the two flows positively impacts decision-making. Additionally, ’certValidDays’, which represents the number…

**Figure 5.** Figure 5: Summary plot of global explanation of XGBoost model trained using CTU-13 dataset ’Flow IAT Min’ feature, as shown in [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Local explanation based on our dataset 4.3 Discussion The global explanation reveals that the mean number of bytes sent and received by a client and server indicates a significant difference in the data transmission [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

**Figure 7.** Figure 7: Local explanation based on CTU-13 dataset patterns between normal traffic and that associated with malware. Specifically, the data transmitted from the server to the client are typically greater in normal traffic than in malware scenarios. This suggests that legitimate…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Anomaly detection in network flows using unsupervised online machine learning
cs.CR 2025-09 reject novelty 3.0 of 10

An online unsupervised One-Class SVM pipeline is claimed to achieve 98%+ accuracy and 100% recall on NF-UNSW-NB15(-v2), but the evaluation leaks test information into scaling and hyperparameter selection.
Interpretable Anomaly Detection in Encrypted Traffic Using SHAP with Machine Learning Models
cs.CR 2025-05 reject novelty 2.0 of 10

A benchmark report claims 99.94% accuracy for XGBoost with SHAP on encrypted traffic datasets, but the reported metrics are internally inconsistent and the evaluation protocol is contradictory.

Reference graph

Works this paper leans on

36 extracted references · 30 canonical work pages · cited by 2 Pith papers

[34]

and Rao, R.S:

Kondaiah, C., Pais, A.R. and Rao, R.S:. Enhanced Malicious Traffic Detection in Encrypted Communication Using TLS Features and a Multi-class Classifier Ensem- ble. J Netw Syst Manage 32, 76 (2024). https://doi.org/10.1007/s10922-024-09847-3

work page doi:10.1007/s10922-024-09847-3 2024
[1]

Identifying Encrypted Malware Traffic with Con- textual Flow Data,

B. Anderson and D. A. McGrew, "Identifying Encrypted Malware Traffic with Con- textual Flow Data," in Proceedings of the 2016 ACM Workshop on Artificial Intel- ligence and Security (AISec@CCS 2016), Vienna, Austria, 2016, pp. 35-46

work page 2016
[2]

Limitless HTTP in an HTTPS World: Inferring the Semantics of the HTTPS Protocol without Decryption,

B. Anderson, A. Chi, S. Dunlop, and D. McGrew, "Limitless HTTP in an HTTPS World: Inferring the Semantics of the HTTPS Protocol without Decryption," in Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy (CODASPY 2019), Richardson, TX, USA, 2019, pp. 267-278

work page 2019
[3]

TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior,

B. Anderson and D. A. McGrew, "TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior," in Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, The Netherlands, 2019, pp. 379-392

work page 2019
[4]

Feature Analysis of Encrypted Malicious Traffic

A. S. Shekhawat, F. Di Troia, and M. Stamp, "Feature Analysis of Encrypted Ma- licious Traffic," CoRR, vol. abs/2312.04596, 2023

work page Pith review arXiv 2023
[5]

A Distance-Based Method for Building an Encrypted Malware Traffic Identification Framework,

J. Liu, Z. Tian, R. Zheng, and L. Liu, "A Distance-Based Method for Building an Encrypted Malware Traffic Identification Framework," IEEE Access, vol. 7, pp. 100014-100028, 2019

work page 2019
[6]

Feature-Selection- Based Ransomware Detection with Machine Learning of Data Analysis,

W. Yu-Lun, C. Jen-Chun, C. Rong-Jaye, and W. Shiuh-Jeng, "Feature-Selection- Based Ransomware Detection with Machine Learning of Data Analysis," in Pro- ceedings of the 2018 3rd International Conference on Computer and Communication Systems (ICCCS), 2018, pp. 85-88

work page 2018
[7]

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

O. M. K. Alhawia, J. Baldwin, and A. Dehghantanha, "Leveraging Machine Learn- ing Techniques for Windows Ransomware Network Traffic Detection," CoRR, vol. abs/1807.10440, 2018

work page Pith review arXiv 2018

Show all 36 references

[8]

Classification of Encrypted Traffic with Second-Order Markov Chains and Application Attribute Bigrams,

M. Shen, M. Wei, L. Zhu, and M. Wang, "Classification of Encrypted Traffic with Second-Order Markov Chains and Application Attribute Bigrams," IEEE Transac- tions on Information Forensics and Security, vol. 12, pp. 1830-1843, 2017

2017
[9]

SSLMaliciousTraffic Detection Based On Multi-view Features,

D.Rui,G.Chuan,L.Bo,Y.Lixia,L.Hongyu,andC.Shaojie,"SSLMaliciousTraffic Detection Based On Multi-view Features," in Proceedings of the 9th International Conference on Communication and Network Security (ICCNS 2019), Chongqing, China, 2020, pp. 40-46

2019
[10]

ME-Box: A Reliable Method to Detect Malicious Encrypted Traffic,

B. Xu, G. He, and H. Zhu, "ME-Box: A Reliable Method to Detect Malicious Encrypted Traffic," Journal of Information Security and Applications, vol. 59, 2021

2021
[11]

A Novel Malware En- crypted Traffic Detection Framework Based On Ensemble Learning,

C. Zhao, S. Li, X. Wu, W. Han, Z. Tian, and M. Chen, "A Novel Malware En- crypted Traffic Detection Framework Based On Ensemble Learning," in Proceedings of the Sixth IEEE International Conference on Data Science in Cyberspace (DSC 2021), 2021, pp. 614-620

2021
[12]

Light-weightUnsupervisedAnomalyDetec- tion for Encrypted Malware Traffic,

S.Han,Q.Wu,H.Zhang,andB.Qin,"Light-weightUnsupervisedAnomalyDetec- tion for Encrypted Malware Traffic," in Proceedings of the 7th IEEE International Conference on Data Science in Cyberspace (DSC 2022), 2022, pp. 206-213

2022
[13]

Multilayer Ran- somware Detection Using Grouped Registry Key Operations, File Entropy and File Signature Monitoring,

B. Jethva, I. Traore, A. Ghaleb, K. Ganame, and S. Ahmed, "Multilayer Ran- somware Detection Using Grouped Registry Key Operations, File Entropy and File Signature Monitoring," Journal of Computer Security, vol. 28, no. 3, pp. 337-373, 2020. Explainable AI for Encrypted Malwar...

2020
[14]

Malware-Traffic-Analysis,

B. Duncan, "Malware-Traffic-Analysis," 2021. [Online]. Available: https://www.malware-traffic-analysis.net [Accessed: June 4, 2023]

2021
[15]

Stratosphere Laboratory Datasets,

Stratosphere, "Stratosphere Laboratory Datasets," 2021. [Online]. Available: https://www.stratosphereips.org/datasets-ctu13 [Accessed: June 11, 2023]

2021
[16]

McGrew, B

D. McGrew, B. Anderson, B. Hudson, and P. Perricone, "Joy," 2017. [Online]. Available: https://github.com/cisco/joy [Accessed: January 3, 2024]

2017
[17]

Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity,

B. Anderson and D. McGrew, "Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity," in Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD 2017), 2017, pp. 1723-1732

2017
[18]

Ensemble Learning for Encrypted Malware Detection and Classification,

S. N. Zeleke, S. Zemene, and M. Bochicchio, "Ensemble Learning for Encrypted Malware Detection and Classification," in Proceedings of the International Confer- ence on Information and Communication Technology for Development for Africa (ICT4DA 2023), 2023, pp. 132-137

2023
[19]

In: Yang, X.-S., Sherratt, R.S., Dey, N., Joshi, A

Fang, Y., Xu, Y., Huang, C., Liu, L., Zhang, L.: Against Malicious SSL/TLS Encryption: Identify Malicious Traffic Based on Random Forest. In: Yang, X.-S., Sherratt, R.S., Dey, N., Joshi, A. (eds.) Proceedings of the Fourth International Congress on Information and Communicatio...

2019
[20]

PLoS One 15(5), 1 (2020)

Zheng, R., Liu, J., et al.: Two-layer detection framework with a high accuracy and efficiency for a malware family over the TLS protocol. PLoS One 15(5), 1 (2020). https://doi.org/10.1371/journal.pone.0232696

2020 doi
[21]

Insurance: Mathematics and Economics 101, 140-162 (2021)

Makariou, D., Barrieu, P., Chen, Y.: A random forest based approach for predict- ing spreads in the primary catastrophe bond market. Insurance: Mathematics and Economics 101, 140-162 (2021). https://doi.org/10.1016/j.insmatheco.2021.07.003

2021 doi
[22]

International Journal of Computer Applications in Technology 62(3), 240-245 (2020)

Chen, J., Zhao, F., Sun, Y., Yin, Y.: Improved XGBoost model based on genetic algorithm. International Journal of Computer Applications in Technology 62(3), 240-245 (2020). https://doi.org/10.1504/ijcat.2020.106571

2020
[23]

IEEE Communications Magazine 60(2), 25-31 (2022)

Zhang, T., Qiu, H., Mellia, M., Li, Y., Li, H., Xu, K.: Interpreting AI for Network- ing: Where We Are and Where We Are Going. IEEE Communications Magazine 60(2), 25-31 (2022). https://doi.org/10.1109/MCOM.001.2100736

2022 doi
[24]

In: Advances in Neural Information Processing Systems 30 (NIPS 2017), pp

Lundberg, S.M., Lee, S.-I.: A Unified Approach to Interpreting Model Predictions. In: Advances in Neural Information Processing Systems 30 (NIPS 2017), pp. 4768-

2017
[25]

CoRR abs/1905.04610 (2019)

Lundberg, S.M., Erion, G.G., Chen, H., DeGrave, A.J., Prutkin, J.M., Nair, B.G., Katz, R., Himmelfarb, J., Bansal, N., Lee, S.-I.: Explainable AI for Trees: From Local Explanations to Global Understanding. CoRR abs/1905.04610 (2019)

2019 arXiv
[26]

and Cao R.-F

Wu Q.-W. and Cao R.-F. and Xia, J.-F. and et al.: Extra Trees Method for Pre- dicting LncRNA-Disease Association Based on Multi-Layer Graph Embedding Ag- gregation. IEEE/ACM Transactions on Computational Biology and Bioinformatics 19(6), 3171-3178 (2022). https://doi.org/10.11...

2022
[27]

and Wu Z

Li M. and Wu Z. and Chen K. and Wang, W.: Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis. Symmetry 14(11) (2022). https://doi.org/10.3390/sym14112329

2022 doi
[28]

and Holodnak J

Jorgensen S. and Holodnak J. and et al.: Extensible Machine Learning for En- crypted Network Traffic Application Labeling via Uncertainty Quantification. IEEE Transactions on Artificial Intelligence 5(1), 420-433 (2024). https://doi.org/10.1109/TAI.2023.3244168

2024
[29]

Computers & Se- curity (2023)

Wang, Z., Fok, K.W., Thing, V.L.L.: Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study. Computers & Se- curity (2023). https://doi.org/10.1016/j.cose.2021.102542 18 Sileshi N. Zeleke et al

2023
[30]

Expert Systems with Applications 241 (2024)

Bonifazi, G., Cauteruccio, F., et al.: A Model-Agnostic, Network Theory-Based Framework for Supporting XAI on Classifiers. Expert Systems with Applications 241 (2024). https://doi.org/10.1016/j.eswa.2023.122588

2024
[31]

and Algarni, A.: Ransomware Detection Using Machine Learning: A Survey

Alraizza A. and Algarni, A.: Ransomware Detection Using Machine Learning: A Survey. Big Data and Cognitive Computing 7(3), 143 (2023). https://doi.org/10.3390/BDCC7030143

2023 doi
[32]

Master’s thesis, Imperial College, London, UK (2019)

Roques, O.: Detecting Malware in TLS Traffic. Master’s thesis, Imperial College, London, UK (2019)

2019
[33]

Technometrics 40, 78-78 (1975)

Ross, S.M.: Introduction to Probability Models. Technometrics 40, 78-78 (1975). https://doi.org/10.1080/00401706.1998.10485493

1975
[115]

https://doi.org/10.1007/978-981-32-9343-4_10

Springer, 2019. https://doi.org/10.1007/978-981-32-9343-4_10

2019 doi
[4777]

Curran Associates Inc., Long Beach, CA, USA (2017)

2017

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [34]

and Rao, R.S:

Kondaiah, C., Pais, A.R. and Rao, R.S:. Enhanced Malicious Traffic Detection in Encrypted Communication Using TLS Features and a Multi-class Classifier Ensem- ble. J Netw Syst Manage 32, 76 (2024). https://doi.org/10.1007/s10922-024-09847-3

work page doi:10.1007/s10922-024-09847-3 2024

[2] [1]

Identifying Encrypted Malware Traffic with Con- textual Flow Data,

B. Anderson and D. A. McGrew, "Identifying Encrypted Malware Traffic with Con- textual Flow Data," in Proceedings of the 2016 ACM Workshop on Artificial Intel- ligence and Security (AISec@CCS 2016), Vienna, Austria, 2016, pp. 35-46

work page 2016

[3] [2]

Limitless HTTP in an HTTPS World: Inferring the Semantics of the HTTPS Protocol without Decryption,

B. Anderson, A. Chi, S. Dunlop, and D. McGrew, "Limitless HTTP in an HTTPS World: Inferring the Semantics of the HTTPS Protocol without Decryption," in Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy (CODASPY 2019), Richardson, TX, USA, 2019, pp. 267-278

work page 2019

[4] [3]

TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior,

B. Anderson and D. A. McGrew, "TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior," in Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, The Netherlands, 2019, pp. 379-392

work page 2019

[5] [4]

Feature Analysis of Encrypted Malicious Traffic

A. S. Shekhawat, F. Di Troia, and M. Stamp, "Feature Analysis of Encrypted Ma- licious Traffic," CoRR, vol. abs/2312.04596, 2023

work page Pith review arXiv 2023

[6] [5]

A Distance-Based Method for Building an Encrypted Malware Traffic Identification Framework,

J. Liu, Z. Tian, R. Zheng, and L. Liu, "A Distance-Based Method for Building an Encrypted Malware Traffic Identification Framework," IEEE Access, vol. 7, pp. 100014-100028, 2019

work page 2019

[7] [6]

Feature-Selection- Based Ransomware Detection with Machine Learning of Data Analysis,

W. Yu-Lun, C. Jen-Chun, C. Rong-Jaye, and W. Shiuh-Jeng, "Feature-Selection- Based Ransomware Detection with Machine Learning of Data Analysis," in Pro- ceedings of the 2018 3rd International Conference on Computer and Communication Systems (ICCCS), 2018, pp. 85-88

work page 2018

[8] [7]

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

O. M. K. Alhawia, J. Baldwin, and A. Dehghantanha, "Leveraging Machine Learn- ing Techniques for Windows Ransomware Network Traffic Detection," CoRR, vol. abs/1807.10440, 2018

work page Pith review arXiv 2018