DSDIR: A Two-Stage Method for Addressing Noisy Long-Tailed Problems in Malicious Traffic Detection

Abstract

In recent years, deep learning based malicious traffic detection (MTD) systems have demonstrated remarkable success. However, their effectiveness tend to decrease because most malicious traffic datasets are suffered from noisy-labeled and long-tailed problems. While numerous approaches have been developed to address these two problems individually, they become inefficient when confronting the combined challenge of noisy long-tailed data, as they typically tackle only a single adverse factor at a time. This paper proposes a two-stage method called Distribution-aware sample Selection and Dynamic Instance-based Relabeling (DSDIR), which simultaneously addresses the impacts of noisy-labeled and long-tailed problems. In the first stage, a noise-independent clean sample selection method is designed to obtain a clean dataset, which converts negative effects of the long-tailed problem into positive ones. In the second stage, dynamic instance-based relabeling is designed to train a model and improve the dataset’s quality simultaneously. Eventually, DSDIR not only produces a balanced and noise-tolerant model but also obtains a clean dataset. Experimental results demonstrate that in the high noise condition of 60% and 80%, the accuracy rate of DSDIR is 5% higher than the state-of-the-art methods. Our code is available at https://github.com/nku-ligl/DSDIR.