Pre-training based deep learning has been used for improving the accuracy of malicious traffic detection. When users use pre-trained encoders to avoid pre-training cost, they may suffer from backdoor attack. In other words, attackers can inject backdoors into these encoders, and trigger backdoors to evade malicious traffic detection. Thus it is necessary to detect the backdoors of these encoders before they are deployed. However, it is challenging, because: (1) traffic triggers are generated dynamically, (2) and encoders output embedding vectors. We hope to use the explanation collapse phenomenon (i.e., backdoor injection changes explanation results) to overcome these challenges. However, existing explanation algorithms are not suitable, because: (1) encoders output embedding vectors, (2) and encoders have no detection boundary. Thus it is necessary to design a special explanation algorithm. We propose MEB, a backdoor detection framework for pre-training based malicious traffic detection. In the detection framework of MEB, we use detection datasets and the explanation algorithm to calculate detection features, and input them into meta classifiers. We detect backdoors according to the prediction results of meta classifiers. In the explanation algorithm of MEB, we calculate the distance between the embedding vectors of explained samples and the embedding vector centroids of benign/malicious samples. We use the gradients of explained samples to the distance to calculate the explanation results. We implement and evaluate MEB in two typical malicious traffic datasets and two typical pre-training algorithms. Experiment results show that MEB can achieve higher detection accuracy and efficiency than baseline detection algorithms.

Recently enterprises and governments face escalating APT attacks, leading to significant economic losses. APT attacks often persist for extended periods, necessitating the storage of extensive audit logs for effective detection. To reduce data storage overhead, enterprises commonly adopt compression strategies. However, efficient compression strategies may introduce additional query overhead. Existing approaches propose data reduction algorithms, but these methods can compromise data integrity, rendering current attack investigation and anomaly-based intrusion detection ineffective.

Web Application Firewalls (WAFs) are a crucial line of defense against web-based attacks. However, an emerging threat comes from protocol-level evasion vulnerabilities, in which adversaries exploit parsing discrepancies between the WAF HTTP parser and those of web applications to circumvent WAFs. Currently, uncovering these vulnerabilities still depends on manual, ad hoc methods. In this paper, we propose WAF Manis, a novel testing methodology to automatically discover protocol-level evasion vulnerabilities in WAFs. We evaluated WAF Manis against 14 popular WAFs including Cloudflare and ModSecurity and 20 popular web frameworks including Laravel and Spring. In total, we discovered 311 protocol-level evasion cases affecting all tested WAFs and applications. Due to the generic nature of protocol-level evasions, these evasion vulnerabilities do not hinge on specific payload patterns and can transmit any malicious payloads - for instance, SQL injection, XSS, or Log4jShell - to the target websites. We further analyzed these vulnerabilities and identified three primary reasons contributing to WAF evasions. We have reported those identified vulnerabilities to the affected providers and received acknowledgments and bug bounty rewards from Cloudflare WAF, Fortinet WAF, Alibaba Cloud WAF, Huawei Cloud WAF, ModSecurity, Go security Team, and the PHP security team.