As more and more network applications have adopted encryption for user privacy, it poses a great challenge to identify increasing types of encrypted traffic. Recent methods mainly focus on leveraging machine learning or deep learning to improve the effectiveness of classification, and achieve good results in their experiments. However, most methods are developed for a limited number of traffic types on a close-world dataset, lacking the ability to transfer knowledge learned from available labeled data of known classes to the identification of unknown classes, of which the data is unseen during training. In this paper, we propose a novel attribute-based zero-shot learning (ZSL) framework for encrypted traffic classification, with both fine granularity for general classification and good scalability for identifying unknown classes. The framework is based on our defined attribute semantic space, consisting of two components: i) a feature-attribute embedding model to learn the mapping between flow features and attributes from seen classes. We use Temporal Convolution Network (TCN) for flow feature embedding and Simple Recurrent Units (SRU) for attribute embedding, with attention mechanisms introduced in both models for interpretability. ii) a GAN-based feature generation model FAE-G that leverages the trained FAE model to improve the generalization of the classifier for unseen classes. For generalized ZSL (GZSL) tasks, we introduce gradient-based rejection to classify both seen and unseen classes in a two-step way. The experimental results demonstrate that our method shows excellent performance in fine-grained classification, and also achieves presentable results in the identification of unknown classes.

With the great changes in network scale and network topology, the difficulty of DDoS attack detection increases significantly. Most of the methods proposed in the past rarely considered the real-time, adaptive ability, and other practical issues in the real-world network attack detection environment. In this paper, we proposed a real-time adaptive DDoS attack detection method RT-SAD, based on the response to the external network when attacked. We designed a feature extraction method based on sketch and an adaptive updating algorithm, which makes the method suitable for the high-speed network environment. Experiment results show that our method can detect DDoS attacks using sampled Netflowunder high-speed network environment, with good real-time performance, low resource consumption, and high detection accuracy.