As networks continue to expand and become more interconnected, the need for novel malware detection methods becomes more pronounced. Traditional security measures are increasingly inadequate against the sophistication of modern cyber attacks. Deep Packet Inspection (DPI) has been pivotal in enhancing network security, offering an in-depth analysis of network traffic that surpasses conventional monitoring techniques. DPI not only examines the metadata of network packets, but also dives into the actual content being carried within the packet payloads, providing a comprehensive view of the data flowing through networks. While the integration of advanced deep learning techniques with DPI has introduced modern methodologies into malware detection and network traffic classification, state-of-the-art supervised learning approaches are limited by their reliance on large amounts of annotated data and their inability to generalize to novel, unseen malware threats. To address these limitations, this paper leverages the recent advancements in self-supervised learning (SSL) and few-shot learning (FSL). Our proposed self-supervised approach trains a transformer via SSL to learn the embedding of packet content, including payload, from vast amounts of unlabeled data by masking portions of packets, leading to a learned representation that generalizes to various downstream tasks. Once the representation is extracted from the packets, they are used to train a malware detection algorithm. The representation obtained from the transformer is then used to adapt the malware detector to novel types of attacks using few-shot learning approaches. Our experimental results demonstrate that our method achieves classification accuracies of up to 94.76% on the UNSW-NB15 dataset and 83.25% on the CIC-IoT23 dataset.

翻译：随着网络持续扩张且互联程度日益加深，对新型恶意软件检测方法的需求变得尤为迫切。传统安全措施在面对现代网络攻击的复杂性时愈发显得力不从心。深度包检测（DPI）通过提供超越传统监控技术的网络流量深度分析，在增强网络安全方面发挥着关键作用。DPI不仅检查网络数据包的元数据，还深入分析数据包载荷中承载的实际内容，从而全面掌握流经网络的数据状态。尽管将先进深度学习技术与DPI相结合已为恶意软件检测和网络流量分类引入了现代方法，但当前最先进的监督学习方法受限于对大量标注数据的依赖，且难以泛化到新型未知恶意软件威胁。为应对这些局限，本文利用自监督学习（SSL）与小样本学习（FSL）的最新进展。我们提出的自监督方法通过SSL训练Transformer模型，以掩蔽部分数据包的方式从海量无标注数据中学习数据包内容（包括载荷）的嵌入表示，从而获得可泛化至多种下游任务的表征。从数据包中提取表征后，将其用于训练恶意软件检测算法。随后利用小样本学习方法，将Transformer获得的表征适配至新型攻击类型的检测。实验结果表明，我们的方法在UNSW-NB15数据集上达到94.76%的分类准确率，在CIC-IoT23数据集上达到83.25%的分类准确率。