Dual Feature Extraction and Fusion for Malicious Traffic Detection based Transformer Encoders

Malicious traffic detection is a critical aspect of network security, essential for protecting networks from privacy leakage and service disruptions. Recent research has demonstrated the effectiveness of deep learning-based methods, with various models employed to extract valuable information from network flows. However, existing approaches predominantly focus on statistical features, often overlooking the rich information embedded in raw bytes of packets. Furthermore, relying solely on statistical features fails to capture the diverse properties of network traffic from multiple perspectives. In this paper, we propose a novel malicious traffic detection model that provides a more comprehensive analysis of network traffic by describing packets from two distinct perspectives: the raw bytes of the packets and the packet-level statistical features. We employ two Transformer encoder architectures to learn these features separately, leveraging the attention mechanism to extract critical information. Finally, to effectively fuse these features, we utilize a co-attention mechanism, resulting in a robust flow-level feature representation for traffic classification. Our experiments on two real-world traffic datasets demonstrate that our method significantly improves the accuracy of malicious traffic detection compared to baseline approaches.