A Method Based on Hierarchical Spatiotemporal Features for Trojan Traffic Detection Trojans are one of the most threatening network attacks currently. HTTPbased Trojan, in particular, accounts for a considerable proportion of them. Moreover, as the network environment becomes more complex, HTTPbased Trojan is more concealed than others. At present, many intrusion detection systems (IDSs) are increasingly difficult to effectively detect such Trojan traffic due to the inherent shortcomings of the methods used and the backwardness of training data. Classical anomaly detection and traditional machine learningbased (TMLbased) anomaly detection are highly dependent on expert knowledge to extract features artificially, which is difficult to implement in HTTPbased Trojan traffic detection. Deep learningbased (DLbased) anomaly detection has been locally applied to IDSs, but it cannot be transplanted to HTTPbased Trojan traffic detection directly. To solve this problem, in this paper, we propose a neural network detection model (HSTFModel) based on hierarchical spatiotemporal features of traffic. Meanwhile, we combine deep learning algorithms with expert knowledge through feature encoders and statistical characteristics to improve the selflearning ability of the model. Experiments indicate that F 1  of HSTFModel can reach 99.4% in real traffic. In addition, we present a dataset BTHT consisting of HTTPbased benign and Trojan traffic to facilitate related research in the field.

An Effective Approach to Classify Abnormal Network Traffic Activities using Wavelet Transform Understanding network activities has become the most significant task in network security due to the rapid growth of the Internet and mobile devices usages. To protect our computing infrastructures and personal data from network intruders or attacks, identifying abnormal activities is critical. Extracting features from network traffic data is considered as an essential task to be performed because it affects the overall performances to identify the activities accurately. Although researchers proposed several approaches, they mainly focused on identifying the best possible technique to detect abnormal network activities. Only a few studies considered utilizing feature extraction techniques. In this paper, we introduced a new approach, with which an integrative information feature set is determined to identify abnormal network activities using wavelet transformation. Instead of extracting features by attributes, the approach uses all attributes information to extract features and to design a reliable learning model to detect abnormal activities by reducing false positives. Two machine learning techniques, Logistic Regression (LR) and Naive Bayes, are utilized to show the effectiveness of the approach. A visualization method is also used to emphasize our approach. As a result, we found that our proposed approach produces a better performance result with less computational time in detecting abnormal network activities.