# A Payload Based Malicious HTTP Traffic Detection Method Using Transfer Semi-Supervised Learning
## 3 Methodology
### Model Initialization  
The purpose of the model initialization step is to train the initial malicious HTTP traffic detection model based on the public labeled dataset \(D^{\text{PU}}\).Since we focus on the payload of single HTTP requests, and payload analysis task is similar with NLP (Natural Language Processing) task [32], we treat malicious HTTP traffic detection as a special text classification problem.  
First, given a HTTP traffic sample \(s=(x,y)\), we have to segment \(x\) into discrete tokens before inputting it into a text classifier. Unlike English sentences that can be naturally segmented into words by space and punctuation, the payload of a HTTP traffic sample is an integrated string. Although some studies used single characters [12,13] or N-gram algorithm [8,19] to segment an integrated string, it would result in a large number of tokens without semantic meanings. For instance, if we set \(N=3\), the N-gram algorithm would segment the payload in Example 1 into many meaningless tokens (e.g., htt, est, cri), which make it difficult for the text classifiers to learn real semantic patterns. Fortunately, the payload of a HTTP traffic sample usually involves a variety of special characters (e.g.,?,?, /). Therefore,  
we use the 26 special characters in HTTP traffic (i.e., ', ', <, >, +, -, '=, [, ], (), [, ], \(\sim\), /, #, :, :,?,!, -, and, @) as the basis for segmentation. We give an example of payload segmentation in Example 2.  
**Example 2**.: _The payload in Example 1 is segmented into http www test com scripts index php id 1 union select 1 2 3 from admin. It can be seen that tokens that have strong semantics related to malicious behaviors (e.g., select, union) are correctly segmented._  
Second, we apply TextCNN proposed in [33] to train the initial detection model, since it shows a good balance between classification accuracy and training efficiency for the text classification tasks. As shown in Figure 2, TextCNN is composed of four sequentially stacked layers, i.e., an embedding layer, a convolutional layer, a pooling layer, and an output layer. (1) The embedding layer is used to transform each discrete token into a low-dimensional semantic vector, so that tokens with similar semantics would be close in vector space. Here, we utilize word2 vec [34] as the embedding technique. Given a HTTP traffic sample \(s=(x,y)\), let the length of \(x\) be \(l\) and the dimension of the semantic vectors be \(d,x\) can then be represented as an \(l\times d\) matrix. Here, we denote the semantic vector corresponding to the ith token in \(x\) as \(\mathbf{v}_{i}\). Note that the payload would be padded or truncated if it was shorter or longer than \(l\). (2) The convolutional layer uses multiple filters with different window sizes to extract feature maps. Specifically, a filter with window size \(h\times d\) is applied to each possible contiguous \(h\) tokens in \(x\) (i.e., the concatenation of the semantic vectors \(\mathbf{v}_{i},\mathbf{v}_{i+1},\ldots,\mathbf{v}_{i+h-1}\), denoted as \(\mathbf{v}_{i+h-1}\)) to  
Figure 1: The architecture of DeepPTSD.  
produce a feature value \(c_{i}=\text{ReLU}(\mathbf{W}\cdot\mathbf{v}_{i:i+h-1}+b)\), where \(\mathbf{W}\) is the weight matrix and \(b\) is the bias term. Thus, each filter would generate a feature vector \(c=[c_{1},c_{2},\dots,c_{l-h+1}]\). (3) The pooling layer applies a max-over-time pooling operation over each feature vector, i.e., it takes the maximum value of the feature vector as the feature value corresponding to the particular filter. Then, by concatenating the pooling results of all filters, we can obtain a final feature vector with uniform length for different payloads (i.e., the length equals to the number of filters). (4) The output layer accepts the final feature vector and output the probability distribution over all the HTTP traffic types based on a fully connected operation.