Recently, effectively identifying encrypted malicious traffic without decryption in consumer applications relies heavily on high-quality labeled traffic datasets. However, this harms models for incorrect labeling and requires more efficient real-time identification of encrypted unknown ones. This paper proposes HyperEye, a real-time, unsupervised, encrypted malicious traffic detection system. It can detect unknown traffic patterns by analyzing the fused traffic features in-depth. Precisely, we extract protocol-agnostic numerical and protocol-specific text features and devise a cross-term fusion algorithm to obtain a comprehensive traffic behavior description. We designed a genetic algorithm-based DBSCAN (GA-DBSCAN) parameter optimization algorithm to enhance the quality and stability in identifying malicious traffic. Extensive experimental results with open-world and real-world datasets demonstrate that our work outperforms other state-of-the-art malware detection systems, achieving an average 11.95% improvement in the F1-score. Besides, experimental results with the real-world dataset demonstrate that our system applies to the dynamic nature of consumer applications and can safeguard users’ data and privacy.

Modern botnets rely on a new DNS technique called fast-flux to organize compromised hosts into fast-flux service networks (FFSNs), which helps bot herds to hide their upstream servers. Given the prevalence of this mechanism, various approaches have been proposed to detect them by analyzing DNS traffic. However, these detection mechanisms either have low detection accuracy or long detection latency. Moreover, they can’t capture the behavioral regularity and other novel traits of the evolving behavior of each botnet which is being tracked. This paper proposes a new FFSNs detection scheme to solve the limitations mentioned above. The proposed approach can recognize groups of domains generated by a DGA (Domain Generation Algorithms) or its variants that are representative of different botnets. In addition to that, it can also identify whether the AGD (Algorithmically Generated Domain) names in a cluster are using fast-flux technology or not by applying a double-stages detection mechanism. The proposed work is implemented in a real network (China Education and Research Network, CERNET) and the DNS traffic is collected from backbone routers. Experimental results demonstrate that our algorithm has significantly increased the detection accuracy compared with similar works and reduced the computational complexity.

Anomaly detection is the first step with a challenging task of securing a communication network, as the anomalies may indicate suspicious behaviors, attacks, network malfunctions, or failures. In this paper, we address the problem of not only detecting different anomalies like volume-based (e.g. DDoS or Falsh crowd) and spatial-based (e.g. network scan) that arise simultaneously in the wild, but also of attributing the anomalous point to a single anomaly event causing it. Besides, we also tackle the problem of low detection accuracy caused by the phenomenon of traffic drift. To this end, a novel adaptive profile-based anomaly detection scheme is proposed. More specifically, a more comprehensive metrics set is defined from the dimensions of temporal, spatial, category and intensity to compose IP traffic behavior characteristic spectrum for fine-grained traffic characterization. Then, digital signature matrix obtained by using ant colony optimization (ACO) algorithm is applied to construct the baseline profile of the normal traffic behavior. Anomalous-points are identified and analyzed by using confidence bands and a generic clustering technique, respectively. Finally, a lightweight updating strategy is applied to reduce the number of false positives. Real world data of China Education Research Network backbone and synthetic data are collected to verify our proposal. Experimental results demonstrate that our approach provides a fine-grained behavior description ability and has significantly increased the detection accuracy compared with other similar alternatives.

With the development of information and technology, especially with the boom in big data, healthcare support systems are becoming much better. However, an early diagnosis is not an easy task because it is hard to find out the hidden patterns in the disease. The symptoms of heart failure are usually non-specific. Therefore, this study aims to devise an early prediction model for incident heart disease based on machine learning algorithms. In this study, we compared several powerful models, including support vector machines (SVM), k-nearest neighbor (KNN), decision tree, extreme gradient boosting (XGBoost), random forest, gradient boosting decision tree (GBDT), categorical boosting (CatBoost), light gradient boosting machine (LightGBM), and choose two best models, namely, XGBoost and LSTM as our prediction model. The XGBoost algorithm was used to extract a subset from the data of patients, which will be fed into the LSTM-XGBoost model for training. An experiment comparison is conducted based on the data from Kaggle. Experimental results demonstrate that the LSTM-XGBoost model can operate effectively with a prediction accuracy achieving 0.9896 and a loss rate achieving 0.0105, which is much better than XGBoost or LSTM, respectively.