A Novel Malware Traffic Classification Method Based on Differentiable Architecture Search

Abstract

The application of deep learning (DL) in the field of network intrusion detection (NID) has yielded remarkable results in recent years. As for malicious traffic classification tasks, numerous DL methods have proved robust and effective with self-designed model architecture. However, the design of model architecture requires substantial professional knowledge and effort of human experts. Neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal, which is a subdomain of automatic machine learning (AutoML). After that, Differentiable Architecture Search (DARTS) has been proposed by formulating architecture search in a differentiable manner, which greatly improves the search efficiency. In this paper, we introduce a model which performs DARTS in the field of malicious traffic classification and search for optimal architecture based on network traffic datasets. In addition, we compare the DARTS method with several common models, including convolutional neural network (CNN), full connect neural network (FC), support vector machine (SVM), and multi-layer Perception (MLP). Simulation results show that the proposed method can achieve the optimal classification accuracy at lower parameters without manual architecture engineering.