Attack-Specific Feature Construction to Detect Malicious TCP Flows

Malicious network flow detection and mitigation is a major part of network security and has been a widely researched topic for decades now. Various approaches, from simple filtering to complex deep packet inspection, were proposed and technologies were leveraged with the recent research focus on the implemen-tation of machine learning (ML), deep learning (DL), and artificial intelligence (AI) techniques. While it is evident that the features representing network traffic patterns play a vital role in the ML, DL, or AI-based network traffic analysis, feature construction received limited attention. The robustness of the frequently used statistical features in network attack detection are unclear. ML models trained with statistical features suffer from out-of-distribution (OOD) problem even when the test set has the same attacks. This paper proposes attack-specific feature construction for TCP-based attacks that exploit protocol features. The results show that the ML models trained with the proposed features effectively detect the same or similar protocol exploits whenever and wherever they occur.