# A Payload Based Malicious HTTP Traffic Detection Method Using Transfer Semi-Supervised Learning
## 3 Methodology
### Transfer Semi-Supervised Learning  
We transfer the initial detection model to the target system by fine-tuning it on \(D^{\text{TSL}}\cup D^{\text{TSU}}\cup GD^{\text{TSL}}\cup GD^{\text{TSU}}\). Here, fine-tuning is known as a process that copies the parameters of the initial model to initialize the corresponding part of the target model and then the target model is retrained through backpropagation with target training samples [28]. The fine-tuning process is performed based on the proposed transfer semi-supervised learn \begin{table}
\begin{tabular}{l l} \hline Rule 1 & Keep all keywords in the keyword library unchanged. \\ Rule 2 & Retain all the special characters (e.g., \%, @, \#). \\ Rule 3 & Randomize each number in the range of [0,9]. \\ Rule 4 & Change each letter into a random letter. \\ \hline \end{tabular}
\end{table} 
Table 1: The rules of payload perturbation. ing framework, which is designed by integrating a semi-supervised learning framework into a transfer learning structure. We explain the details as follows. First, the transfer learning structure is designed based on the idea proposed in [28]. The parameters of the initial model are copied to the target model. Then, the first \(n\) layers of the target model are frozen, and then the parameters of the rest layers are retrained based on the dataset of the target system. A frozen layer means that it does not change during retraining. We explain the idea as follows. (1) We do not retrain all the layers, since this would cause catastrophic forgetting, eliminating the knowledge of the initial model. Especially, if the dataset of the target system is small, retraining all layers would easily result in overfitting [41]. (2) We leave the last a few layers unfrozen, since they contain the most specific knowledge that should be learnt from the target system [28]. For example, if the public dataset and the dataset of target system have different types of malicious HTTP traffic, the last layer of TextCNN (i.e., the output layer) is mandatory to be retrained. Second, to better exploit the labeled and unlabeled samples from the target system, we conduct the fine-tuning process in a semi-supervised learning style. In all the deep semi-supervised learning styles, the smoothness enforcing method tries to regularize the model's prediction to be less sensitive to small perturbations [41; 42; 43]. The smoothness enforcing method is the most suitable deep semi-supervised learning style for our problem, since it is able to exploit all the labeled, unlabeled, and augmented samples. Specifically, given an original sample so, the smoothness enforcing method creates a perturbed version of \(s_{o}\) (denoted as \(s_{p}\)), and then trains the model to output similar predictions on \(s_{o}\) and \(s_{p}\). In our problem, the payload data augmentation operation corresponds to the perturbation operation of the smoothness enforcing method. To this end, we leverage and refine the UDA framework proposed in [43] to perform the smoothness enforcing based semi-supervised learning. Specifically, we fine-tune the initial model to minimize the loss function in Equation (2), where \(LL\big{(}D^{\text{TSL}}\cup GD^{\text{TSL}}\big{)}\) and \(UL\big{(}D^{\text{TSU}}\cup GD^{\text{TSU}}\big{)}\) denote the loss on labeled datasets (i.e., \(D^{\text{TSL}}\) and \(GD^{\text{TSL}}\) ) and unlabeled datasets (i.e., \(D^{\text{TSU}}\) and \(GD^{\text{TSU}}\big{)}\), \(\lambda\) is a trade-off weight, \(p_{\theta}(x)\) denotes the predicted label distribution of sample \(x\) based on the current model parameters \(\theta,\delta(x)\) is the real label distribution of sample \(x\) (i.e., a one-shot vector where only the entry corresponding to the real label is 1), \(x^{*}\sim A_{\text{PL}}(x)\) represents the augmented sample generated from sample \(x\), and \(D_{\text{KL}}(p_{\theta}(x)\|p_{e}(x^{*}))\) represents KL divergence between \(p_{\theta}(x)\) and \(p_{\theta}(x^{*})\).