A stable noise injection method and robust learning framework for malicious traffic detection

Abstract Noise injection methods evaluate the generalization and robustness of malicious traffic detection models by corrupting clean dataset labels to produce diverse noisy label datasets. This study systematically analyzes the impact of existing noise injection methods on model performance and reveals that high-noise-rate datasets often distort the labels of simple samples, yielding noise distributions inconsistent with real-world scenarios. To overcome this issue, we propose S-IDN, a malicious traffic noise injection method that generates a more stable noise distribution closely aligned with realistic labeling errors. Experimental results show that the stability of S-IDN surpasses that of existing methods by 57.4% and 81.9% on two benchmark datasets. Furthermore, we introduce Robust Label, a robust learning framework for malicious traffic detection. By evaluating label robustness during training, it selects clean and noisy samples adaptively and employs multiple loss functions to construct precise decision boundaries. Under extreme noise conditions (noise rate = 0.9), Robust Label achieves accuracy above 80% for binary detection and 60% for multiclass detection, outperforming the best existing models by up to 13.01% and 9.34%, respectively. Extensive experimental results demonstrate the superior efficiency and robustness of Robust Label for malicious traffic detection.