Abstract: The class imbalance problem in the public data sets of malicious encrypted traffic identification seriously affects the performance of malicious traffic prediction. In this paper, we propose to use the generator and discriminator in the depth generation adversarial network DGAN to simulate the generation of real data sets and the expansion of small sample data to form balanced data sets. In addition, in order to solve the problems that traditional machine learning methods rely on artificial feature extraction, which leads to the decrease of classification accuracy, a malicious traffic recognition model based on the combination of two-way gating loop unit BiGRU and attention mechanism is proposed. The deep learning algorithm automatically obtains the important feature vectors of different time series of data sets to identify malicious traffic. Experiments show that compared with the common malicious traffic recognition algorithms, the model has a good improvement in accuracy, recall, F1 and other indicators, and can effectively realize the identification of malicious encrypted traffic.

Key words: malicious encrypted traffic, generation adversarial network, class imbalance, traffic identification