Encryption Traffic Anomaly Detection Technology Using Artificial Intelligence Methods

To safeguard against numerous network attacks in environments where communication is not encrypted, an increasing number of online application services are adopting encrypted traffic to improve privacy and security. However, it was soon found that attackers could exploit secure communication channels to conduct cyber attacks. Traditional techniques, which rely on deep packet inspection to detect anomalous traffic, struggle to identify these types of attacks effectively. In recent years, the progress of artificial intelligence has prompted many researchers to apply AI-based approaches for detecting encrypted network traffic. This paper centers on the UNSW-NB15 dataset and provides a comprehensive retrospect of advancements in encrypted traffic anomaly detection techniques based on this dataset over the past few years. Initially, it categorizes and summarizes existing studies from three perspectives: traditional machine learning, deep learning, and unsupervised or semi-supervised learning methods, while comparing their performance in terms of classification accuracy, detection efficiency, and suitability for different scenarios. Furthermore, by evaluating and analyzing the experimental outcomes of these approaches on the UNSW-NB15 dataset, the paper highlights the strengths and limitations of various technical strategies. Finally, it outlines the current challenges and potential directions for future research in the field of encrypted traffic analysis.