Real-Time Malicious Traffic Detection Based on Frequency Domain Features

As an emerging security paradigm, machine learning (ML) based malicious traffic detection has the potential to detect zero-day attacks. However, current ML based detection methods suffer from low throughput and accuracy due to inefficient traffic feature extraction. Consequently, they are unable to detect attacks in real-time and can be circumvented by sophisticated attacks. To address these limitations, this paper proposes a real-time malicious traffic detection algorithm by combining the extraction of traffic frequency domain features with the Isolation Forest algorithm. By utilizing frequency domain features with low redundancy and information loss, the proposed method achieves high accuracy and real-time performance. Attackers can hardly manipulate frequency domain features, enabling effective detection of various circumvention techniques. Experimental results demonstrate the high accuracy of the proposed method in the real-time detection of malicious traffic.