# MT-FBERT: Malicious Traffic Detection Based on Efficient Federated Learning of BERT
## 4 Experiments  
### Experiment Setup  
#### 4.1.1 Datasets  
To evaluate the performance of the proposed MT-FBERT, we conducted comprehensive experiments utilizing four publicly available datasets encompassing diverse attack types that are representative of actual cyber threats encountered in the hydropower sector. The selected datasets include USTC-TFC2016 [52], IoT-22 [53], IoT-23 [54], and CIC-MalAnal2017 [55].  
The USTC-TFC2016 dataset comprises encrypted network traffic samples categorized into 10 distinct malware families and 10 benign application types. The malware samples include prominent threats such as Cridex, Geodo, Htbot, Miuref, Neris, Nsis-ay, Shifu, Tinba, Virut, and Zeus. The benign traffic encompasses common network applications, including BitTorrent, Facetime, FTP, Gmail, MySQL, Outlook, Skype, SMB, Weibo, and WorldOfWarcraft.  
The IoT-22 dataset was systematically collected across six operational states of IoT devices: Power-on initialization, Idle standby mode, Normal user interactions, Predefined usage scenarios, Active operation, and Attack conditions. During the Attack state, malicious traffic is collected by executing two distinct attacks: UDP/HTTP Flood attacks and RTSP Brute Force attacks.  
The IoT-23 dataset encompasses 33 labeled attack variants, which have been classified into seven threat categories: Distributed Denial-of-Service attacks, Denial-of-Service attacks, Reconnaissance activities, Web-based exploits, Credential brute-force attempts, Network spoofing attacks, and Mirai botnet-related malicious activities.  
The CICMaLAnal2017 dataset includes 4354 malicious specimens and 6500 benign applications. The malware corpus is classified into four principal categories: Adware, Ransomware, Scareware, and SMS-based malware. These categories encompass 42 well-documented malware families that exhibit diverse malicious capabilities.  
For the raw.pcap files in the above-mentioned datasets, data preprocessing is performed:  
1. Flow Segmentation: The open-source tool SplitCap [56] is used to divide the raw network traffic based on TCP and UDP sessions. A session is defined as a group of packets sharing the same 5-tuple (source IP, destination IP, source port, destination port, and transport protocol).
2. Session Filtering and Cleaning: Small sessions are removed. Non-payload metadata fields, such as the Global Header and Packet Header, are excluded. Duplicate packets are also merged or removed to reduce redundancy.  
After data preprocessing, the dataset exhibited a flow imbalance. For instance, in the USTC-TFC2016 dataset, the number of flows for the Shifu threat is 2, while the Cridex threat has 8189 flows. To mitigate this issue, we merged flows from selected malicious categories, and the restructured dataset is presented in Table 1.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset** & **Network Traffic Categories** & **The Number of Flows** \\ \hline \multirow{3}{*}{USTC-TFC2016} & Benign & 15,000 \\ \cline{2-3}  & Malicious & 14,207 \\ \hline \multirow{3}{*}{IoT-22} & Benign & 23,000 \\ \cline{2-3}  & Malicious & 22,900 \\ \hline \multirow{3}{*}{IoT-23} & Benign & 23,264 \\ \cline{2-3}  & DoS and DDoS & 20,000 \\ \cline{2-3}  & MITM and Spoofing & 11,516 \\ \cline{2-3}  & Recon and Scanning & 17,768 \\ \hline \multirow{3}{*}{CICMaLAnal2017} & Benign & 243,577 \\ \cline{2-3}  & Adware & 70,173 \\ \cline{1-1} \cline{2-3}  & Ransomware & 68,032 \\ \cline{1-1} \cline{2-3}  & Scareware & 76,761 \\ \cline{1-1} \cline{2-3}  & SMSMalware & 45,258 \\ \hline \hline \end{tabular}
\end{table}
Table 1: The datasets’ information after data preprocessing.