Metrics
11 Record Views
Conference proceeding
Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach
MILCOM IEEE Military Communications Conference, pp.847-852
IEEE Military Communications Conference
MILCOM 2024: IEEE Military Communications Conference (Washington, District of Columbia (DC), USA, 10/28/2024–11/01/2024)
10/28/2024
Web of Science ID: WOS:001419571100165
Abstract
As the complexity and connectivity of networks increase, the need for novel malware detection approaches becomes imperative. Traditional security defenses are becoming less effective against the advanced tactics of today's cyberattacks. Deep Packet Inspection (DPI) has emerged as a key technology in strengthening network security, offering detailed analysis of network traffic that goes beyond simple metadata analysis. DPI examines not only the packet headers but also the payload content within, offering a thorough insight into the data traversing the network. This study proposes a novel approach that leverages a large language model (LLM) and few-shot learning to accurately recognizes novel, unseen malware types with few labels samples. Our proposed approach uses a pretrained LLM on known malware types to extract the embeddings from packets. The embeddings are then used alongside few labeled samples of an unseen malware type. This technique is designed to acclimate the model to different malware representations, further enabling it to generate robust embeddings for each trained and unseen classes. Following the extraction of embeddings from the LLM, few-shot learning is utilized to enhance performance with minimal labeled data. Our evaluation, which utilized two renowned datasets, focused on identifying malware types within network traffic and Internet of Things (IoT) environments. Our approach shows promising results with an average accuracy of 86.35% and F1-Score of 86.40% on different malware types across the two datasets.
Related links
Details
- Title
- Towards Novel Malicious Packet Recognition
- Publication Details
- MILCOM IEEE Military Communications Conference, pp.847-852
- Resource Type
- Conference proceeding
- Conference
- MILCOM 2024: IEEE Military Communications Conference (Washington, District of Columbia (DC), USA, 10/28/2024–11/01/2024)
- Publisher
- Institute of Electrical and Electronics Engineers (IEEE)
- Series
- IEEE Military Communications Conference
- Number of pages
- 6
- Grant note
- UWF Argo Cyber - National Science Foundation (NSF): 1946442
This work is partially supported by the UWF Argo Cyber Emerging Scholars (ACES) program funded by the National Science Foundation (NSF) CyberCorps (R) Scholarship for Service (SFS) award under grant number 1946442. Any opinions, findings, and conclusions or recommendations expressed in this document are those of the authors and do not necessarily reflect the views of the NSF.
- Copyright
- © 2024, IEEE
- Identifiers
- WOS:001419571100165; 99380592465706600
- Academic Unit
- Center for Cybersecurity; Division of Academic Affairs
- Language
- English