Encrypted Malicious Traffic Detection in Dynamic ICV Networks

ABSTRACT While encrypted traffic ensures secure communications, it also provides covert channels for some advanced attacks, making them difficult to detect. Detection is particularly difficult in the context of intelligent connected vehicles (ICVs), where there are two huge challenges: (1) ICVs dynamic network topologies induce traffic pattern drift, rendering traditional static detection models obsolete. (2) The coexistence of heterogeneous sensors and diverse data sources blurs traffic boundaries, degrading detection efficacy and manifesting persistent false negatives. To address these challenges, we propose an architecturally novel paradigm GraphSAGE‐KAN. Initially, time‐aware flow graphs are constructed through the encoding of communication mechanisms into dynamically weighted edges. This approach can bridge transport‐application semantics and mitigate the problem of blurred boundaries between traffic. Subsequently, node features are optimized through Laplacian scores and Spearman's rank coefficient analysis, which can address the problem of traffic pattern drift, ensuring the selection of discriminative features. Finally, graphs are processed using a GraphSAGE‐KAN, which effectively “lifts” the aggregated features into a higher‐dimensional manifold, enabling the network to approximate any continuous function over its local receptive field. Experiments were conducted using the IoT environment datasets (public datasets) and real‐world attack datasets. Compared with the current method, the proposed method shows better performance in terms of accuracy, precision, recall, F1 score, and false positive rate.