Detecting Encrypted Malicious Traffic with an SPDConv-Enhanced 1D CNN

The rapid proliferation of network-layer encryption (e.g., HTTPS, SSH, TLS) safeguards user privacy while simultaneously affording attackers a convenient cloak for malicious activity. Traditional detection schemes that couple feature engineering with classical machine-learning classifiers suffer from labor-intensive feature extraction, high computational overhead, and limited real-time performance. End-to-end one-dimensional convolutional neural networks (1D-CNNs) learn raw byte-level representations more effectively, yet still incur heavy costs when down-sampling or enlarging the receptive field. Inspired by the “Space-to-Depth $+1 \times 1$ convolution (SPDConv)” paradigm in two-dimensional vision tasks, we introduce SPDConv into a 1-D network for the first time, replacing conventional high-cost down-sampling or dilated convolutions. On a subset of the CICIDS2017 dataset, we compare a Baseline-CNN, a Dilated-CNN, and an SPDConv-CNN with folding factors $\mathbf{r}=2$ and $\mathbf{r}=4$. Results show that SPDConv-CNN maintains high classification accuracy while sharply reducing parameters and FLOPs, cutting inference latency by more than $50 \%$, thereby providing significant lightweight advantages.