Malicious encrypted traffic identification model based on flow space-time features

The rapid proliferation of encrypted traffic in modern networks presents significant challenges for security monitoring and threat detection. While encryption enhances privacy, it also provides cover for malicious activities, making traditional deep packet inspection ineffective. To address this challenge, this paper proposes an interpretable and efficient deep learning framework for malicious encrypted traffic identification. Our model integrates 1D-CNN, BiLSTM, and a lightweight self-attention mechanism to capture both spatial and temporal characteristics of network flows while providing explainable predictions through attention visualization. Unlike computationally intensive Transformer-based approaches, our method achieves an optimal balance between accuracy and efficiency, making it suitable for real-world deployment. Extensive experiments on benchmark datasets (USTC-TFC2016 and CICIDS-2017) demonstrate that our model achieves high accuracy with 0.82 ms inference time per flow, outperforming state-of-the-art methods while offering transparency in decision-making for security analysts. The proposed approach not only enhances detection performance but also provides operational interpretability, bridging the gap between automated threat detection and human-in-the-loop security operations.