臺灣博碩士論文加值系統

隨著通訊技術的快速發展，人們對於網際網路的依賴與日俱增。因此，許多有心人士亦開始利用網路進行犯罪，而現在的網路攻擊手法結合木馬程式(Trojan)、殭屍網路(Botnet)、社交工程(Social engineering)與釣魚網站(Phishing)等技術。釣魚網站的防禦研究涉及各個層面，但主要集中在防止欺騙性網路釣魚，而釣魚網站的存活時間短且攻擊手法複雜，其成為資訊安全威脅的隱憂，此外，當前識別機制過度依賴於人工判讀，在即時收集情報方面效率偏低。
本研究提出一智慧化之混合學習架構，結合機器學習(Machine Learning)與深度學習(Deep Learning)，針對各種可疑網站建立學習模型、特徵分析與危害評估等機制研發。由於釣魚網站主要是針對合法網站之頁面進行模擬，因此在收集數據上將會發生數據不平衡(Data Imbalance)之問題。本研究針對上述之問題加入了生成對抗模型(Generative Adversarial Networks, GANs)，以產生少數類別之數據資料集，進而解決模型偏移之議題，且為了讓模型能更快收斂且效率更高，本研究加入自編碼(Autoencoder)架構，進行數據映射及降維，盡可能將兩類數據集進行區分，以提高本身架構之準確率及穩定性。在進行上述所提出之架構訓練前，本研究利用ANOVA、X^2、Information Gain等機制進行初步的數據分析，將不具關聯性或帶有雜訊之特徵提前濾除，進而提高模型之穩定性及可靠性。
本研究所提出之混合學習架構最後產生兩個釣魚偵測模型進行相互交換偵測，以達偵測時之服務效率及其穩定性。由於機器學習模型之收斂時間比深度學習模型還要快，因此本研究於系統上線時，先輸出XGBoost演算法所訓練出來之偵測模型進行檢測，其準確率可達99.67%。待深度學習模型CNN架構訓練完畢後，將偵測模型轉換為CNN架構所訓練出來之模型，並將XGBoost模型送至後端進行更新，以達到相互合作之目的，確保整體環境之運作可達到高度安全性及穩定性，其CNN架構之準確率可達99.83%。

People have become increasingly dependent on information technology since the emergence of the Internet. Consequently, hackers engage in financial crimes and computer attacks through the Internet. Nowadays, cyber-attacks may involve Trojans, botnets, social engineering, spam, and other means. Phishing websites normally have short lifetime, and involve a more complex form of attack. They have therefore attracted increasing attention in the area of information security. The prevention of phishing has various elements. In recent years, related research has focused on the prevention of fraudulent phishing. However, current mechanisms and processes for identifying rely too much on manual identification, which is inefficient for the real-time phishing information collection.
This study proposes a hybrid learning architecture that combines various developed Machine Learning and Deep Learning mechanisms, including the suspicious website learning model, feature analysis and hazard assessment, etc. Phishing websites typically imitate legitimate websites, so the number of phishing websites is much larger than the legitimate websites, which arise the issues of data imbalance between the phishing website and legitimate website during data collection. Also, data imbalance leads the model trending to the category with larger number of data. To solve the problem of model migration, this study utilizes Generative Adversarial Networks (GANs) to generate new instances, which complement the category with lesser data. Furthermore, to make the model more convergent and more efficient, an Autoencoder architecture that reduces feature dimensionality and mapping the data is added. Before implement the above-mentioned model training, features are evaluated using mechanisms that include ANOVA, X^2 and Information Gain, so as to filter out unrelated feature or feature with noise as much as possible to improve the stability and reliability of the model.
To achieve real-time detection of phishing website and high stability, the hybrid learning architecture eventually generates two phishing detection models to cooperate with each other for phishing detection. Since the convergence time of the machine learning model is much shorter than the deep learning model, the XGBoost detection model (machine learning model) is used initially. After complete the training of deep learning model, the XGBoost model will be replaced by the CNN model (deep learning model) and updated itself afterwards. Experimental results indicate that the accuracy of XGBoost model can reach 99.67% and the CNN model in this investigation has an accuracy of 99.83%.

摘要 I
Abstract II
Acknowledgement IV
Contents V
List of Figures VIII
List of Table XIII
List of Algorithm XV
Chapter 1 Introduction 1
Chapter 2 Background Knowledge 7
2.1 Phishing Concept 7
2.2 Anti-Phishing Techniques 9
2.2.1 Blacklist 10
2.2.2 Visual Similarity Analysis 10
2.2.3 Heuristics Analysis 12
2.3 Artificial Intelligence 16
2.3.1 Machine Learning Algorithm 16
2.3.1.1 Support Vector Machine 16
2.3.1.2 K Nearest Neighbor 19
2.3.1.3 Logistic Regression 20
2.3.1.4 Decision Tree 21
2.3.1.5 Naïve Bayes 22
2.3.1.6 Random Forest 23
2.3.1.7 eXtreme Gradient Boosting 25
2.3.2 Deep Learning Architecture 28
2.3.2.1 Recurrent Neural Network 28
2.3.2.2 Long-Short Term Memory Network 29
2.3.2.3 Convolutional Neural Network 30
2.3.2.4 Generative Adversarial Network 33
2.3.2.5 Autoencoder 35
2.4 Data Imbalance Method 36
2.4.1 Under-sampling Mechanism 37
2.4.2 Over-sampling Mechanism 37
2.4.2.1 Random over-sampling 37
2.4.2.2 Synthetic Minority Over-sampling TEchnique (SMOTE) 37
2.4.2.3 Borderline Synthetic Minority Over-sampling Technique 38
2.4.2.4 SNOCC over-sampling 39
Chapter 3 Intelligent Hybrid Learning Architecture 39
3.1 System Overview 39
3.1.1 Data Processing Layer 41
3.1.1.1 Training Dataset 41
3.1.1.2 Feature Extraction Module 42
3.1.1.3 Data Evaluation Module 46
3.1.1.4 Data AutoEncoder-Decoder Module 49
3.1.1.5 Data Generation Module 50
3.1.2 Data Training Layer 51
3.1.3 Data Testing Layer 52
3.2 Offline Phase 52
3.3 Online Phase 55
Chapter 4 System Performance Analysis 59
4.1 System Environment 59
4.1.1 Experimental Environment 59
4.1.2 Experimental Architecture Parameter 60
4.2 Performance Analysis 62
4.2.1 Performance Analysis with Bagging Mechanism 63
4.2.2 Performance Analysis with Voting Mechanism 64
4.2.3 Performance Analysis with Adaboost Mechanism 66
4.2.4 Performance Analysis with Random Forest Mechanism 68
4.2.5 Performance Analysis with XGBoost Mechanism 70
4.2.6 Performance Analysis with Back Propagation Architecture 72
4.2.6.1 Back propagation with SGD optimization Mechanism 73
4.2.6.2 Back propagation with Momentum and Nesterov optimization Mechanism 75
4.2.6.3 Back propagation with Adagrad optimization Mechanism 78
4.2.6.4 Back propagation with Adadelta optimization Mechanism 80
4.2.6.5 Back propagation with RMSprop optimization Mechanism 82
4.2.6.6 Back propagation with Adam optimization Mechanism 84
4.2.7 Performance Analysis with LSTM Architecture 85
4.2.7.1 LSTM with SGD optimization Mechanism 86
4.2.7.2 LSTM with Momentum and Nesterov optimization Mechanism 87
4.2.7.3 LSTM with Adagrad optimization Mechanism 90
4.2.7.4 LSTM with Adadelta optimization Mechanism 92
4.2.7.5 LSTM with RMSprop optimization Mechanism 94
4.2.7.6 LSTM with Adam optimization Mechanism 95
4.2.8 Performance Analysis with CNN Architecture 97
4.2.8.1 CNN with SGD optimization Mechanism 97
4.2.8.2 CNN with Momentum and Nesterov optimization Mechanism 100
4.2.8.3 CNN with Adagrad optimization Mechanism 103
4.2.8.4 CNN with Adadelta optimization Mechanism 105
4.2.8.5 CNN with RMSprop optimization Mechanism 106
4.2.8.6 CNN with Adam optimization Mechanism 108
4.2.9 Further Analysis for Imbalanced Learning 109
4.2.9.1 Analysis with SMOTE Mechanism 110
4.2.9.2 Analysis with GAN Architecture 111
4.2.9.3 Analysis with Autoencoder Architecture 111
4.2.9.4 Further Analysis with XGBoost Mechanism 116
4.2.9.5 Further Analysis with CNN Architecture 118
4.3 Comparison of different papers 121
4.4 Summary 123
Chapter 5 Conclusions and Future Work 127
5.1 Conclusions 127
5.2 Future Work 129
References 131

[1] H. Shirazi, K. Haefner and I. Ray, "Fresh-Phish: A Framework for Auto-Detection of Phishing Websites," Proceedings of the IEEE International Conference on Information Reuse and Integration (IRI), pp. 137-143, 2017.
[2] A. J. Park, R. N. Quadari and H. H. Tsang, "Phishing Website Detection Framework through Web Scraping and Data Mining," Proceedings of the IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON), pp. 680-684, 2017.
[3] APWG, Unifying the Global Response to Cybercrime(https://www.antiphishing.org/)
[4] Z. A. Wen, Y. Li, R. Wade, J. Huang and A. Wang, "What.Hack: Learn Phishing Email Defence the Fun Way," Proceedings of the CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA '17), pp. 234-237, 2017.
[5] J. Mao, W. Tian, P. Li, T. Wei and Z. Liang, "Phishing-Alarm: Robust and Efficient Phishing Detection via Page Component Similarity," Journal of the IEEE Access, Vol. 5, pp. 17020-17030, 2017.
[6] S. Afroz and R. Greenstadt, "PhishZoo: Detecting Phishing Websites by Looking at Them," Proceedings of the IEEE Fifth International Conference on Semantic Computing, pp. 368-375, 2011.
[7] Q. Cui, G. V. Jourdan, G. V. Bochmann, R. Couturier and I. V. Onut, "Tracking Phishing Attacks Over Time," Proceedings of the 26th International Conference on World Wide Web (WWW '17), pp. 667-676, 2017.
[8] J. Saxe and K. Berlin, "eXpose: A Character-Level Convolutional Neural Network with Embeddings for Detecting Malicious URLs, File Paths and Registry Keys,” Journal of CoRR, Vol.abs/1702.08568, 2017.
[9] A. Subasi, E. Molah, F. Almkallawi and T. J. Chaudhery, "Intelligent Phishing Website Detection Using Random Forest Classifier," Proceedings of the International Conference on Electrical and Computing Technologies and Applications (ICECTA), pp. 1-5, 2017.
[10] J. Zhang and Y. Wang, "A Real-Time Automatic Detection of Phishing URLs," Proceedings of Computer Science and Network Technology (ICCSNT), pp. 1212-1216, 2012.
[11] A.K. Jain and B.B. Gupta, "Comparative Analysis of Features Based Machine Learning Approaches for Phishing Detection," Proceedings of the International Conference on Computing for Sustainable Global Development, pp.2125-2130, 2016.
[12] D. Miyamoto, H. Hazeyama and Y. Kadobayashi, "An Evaluation of Machine Learning-Based Methods for Detection of Phishing Sites," Proceedings of the 15th international conference on Advances in neuro-information processing, pp. 539-546, 2008.
[13] R. S. Rao and A. R. Pais, "Detecting Phishing Websites Using Automation of Human Behavior," Proceedings of the 3rd ACM Workshop on Cyber-Physical System Security (CPSS '17), pp. 33-42, 2017.
[14] Anandita, D. P. Yadav, P. Paliwal, D. Kumar and R. Tripathi, "A Novel Ensemble Based Identification of Phishing E-Mails," Proceedings of the 9th International Conference on Machine Learning and Computing (ICMLC 2017), pp. 447-451, 2017.
[15] N. O. F. Elssied, O. Ibrahim and A. H. Osman, "A Novel Feature Selection Based on One-Way ANOVA F-Test for E-Mail Spam Classification," Journal of Applied Sciences, Engineering and Technology, Vol. 7, No. 3, pp. 625-638, 2013.
[16] K. L. Chiew, E. H. Chang, S. N. Sze and W. K. Tiong, "Utilisation of Website Logo for Phishing Detection," Journal of the Computers and Security, Vol. 54, pp.16-26, 2015.
[17] J. Jung and E. Sit, "An Empirical Study of Spam Traffic and the Use of Dns Black Lists," Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pp. 370-375, 2004.
[18] L. Wenyin, N. Fang, X. Quan, B. Qiu and Gang Liu, "Discovering Phishing Target Based on Semantic Link Network," Journal of Future Generation Computer Systems, Vol. 26, No. 3, pp. 381-388, 2010.
[19] How Quad9 works, Internet Security & Privacy In a Few Easy Steps(https://www.quad9.net/)
[20] S. Haruta, H. Asahina and I. Sasase, "Visual Similarity-Based Phishing Detection Scheme Using Image and CSS with Target Website Finder," Proceedings of the IEEE Global Communications Conference, pp. 1-6, 2017.
[21] G. Wang, H. Liu, S. Becerra, K. Wang, S. Belongie, H. Shacham and Stefan Savage, "Verilogo: Proactive Phishing Detection via Logo Recognition," Technical Report CS2011-0669, pp. 1-20 2011.
[22] J.S. White, J.N. Matthews and J.L. Stacy, "A Method for the Automated Detection of Phishing Websites through Both Site Characteristics and Image Analysis," Proceedings of the Society of Photo-Optical Instrumentation Engineers(SPIE), Vol. 8408, pp. 84080B, 2012.
[23] Z. Zhang, Q. He and B. Wang, "A Novel Multi-Layer Heuristic Model for Anti-Phishing," Proceedings of the 6th International Conference on Information Engineering (ICIE '17), pp.21:1-21:6, 2017.
[24] R. Porkodi, "Comparison of Filter Based Feature Selection Algorithms: An Overview," International Journal of the Innovative Research in Technology & Science(IJIRTS), Vol. 2, No.2, pp.108-113, 2014.
[25] A. Abunadi, O. Akanbi and A. Zainal, "Feature Extraction Process: A Phishing Detection Approach," Proceedings of the 13th International Conference on Intellient Systems Design and Applications, pp. 331-335, 2013.
[26] E. H. Chang, K. L. Chiew, S. N. Sze and W. K. Tiong, "Phishing Detection via Identification of Website Identity," Proceedings of the International Conference on IT Convergence and Security (ICITCS), pp. 1-4, 2013.
[27] M. Dash, H. Liu and H. Matthews, "Consistency Based Feature Selection," Proceedings of the Pacific-Asia Conference on Knowledge Discovery and Data Mining, pp. 98-109, 2000.
[28] A. C. Bahnsen, E. C. Bohorquez, S. Villegas, J. Vargas and F. A. González, "Classifying Phishing URLs Using Recurrent Neural Networks," Proceedings of the APWG Symposium on Electronic Crime Research (eCrime), pp. 1-8, 2017.
[29] D. R. Ibrahim and A. H. Hadi, "Phishing Websites Prediction Using Classification Techniques," Proceedings of the International Conference on New Trends in Computing Sciences (ICTCS), pp. 133-137, 2017.
[30] M. A. Janabi, E. D. Quincey and P. Andras, "Using Supervised Machine Learning Algorithms to Detect Suspicious URLs in Online Social Networks," Proceedings of the IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining 2017 (ASONAM '17), pp. 1104-1111, 2017.
[31] R.L. Plackett, "Karl Pearson and the Chi-Squared Test," Proceedings of the International Statistical Review, pp. 59-72, 1983.
[32] R. Verma and A. Das, "What's in a URL: Fast Feature Extraction and Malicious URL Detection," Proceedings of the 3rd ACM on International Workshop on Security and Privacy Analytics (IWSPA '17), pp. 55-63, 2017.
[33] L. Rokach and O. Maimon, "Top-Down Induction of Decision Trees Classifiers - a Survey," Journal of the IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), Vol. 35, No. 4, pp. 476-487, 2005.
[34] A. S. More and D. P. Rana, "Review of Random Forest Classification Techniques to Resolve Data Imbalance," Proceedings of the 1st International Conference on Intelligent Systems and Information Management (ICISIM), Aurangabad, pp. 72-78, 2017.
[35] Misha Denil, David Matheson and Nando de Freitas, "Narrowing the Gap: Random Forests In Theory and In Practice," Proceedings of the International Conference on Machine Learning, Beijing, pp. 1-9, 2014.
[36] "UCI Machine Learning Repository: Phishing Websites Data Set." [Online]. Available: https://archive.ics.uci.edu/ml/datasets/Phishing+Websites
[37] Z. Hu, R. Chiong, I. Pranata, W. Susilo and Y. Bao, "Identifying Malicious Web Domains Using Machine Learning Techniques with Online Credibility and Performance Data," Proceedings of the IEEE Congress on Evolutionary Computation (CEC), pp. 5186-5194, 2016.
[38] S. Tayeb, M. Pirouz, J. Sun, K. Hall, A. Chang, J. Li, C. Song, A. Chauhan, M. Ferra, T. Sager, J. Zhan and S. Latifi, "Toward Predicting Medical Conditions Using K-Nearest Neighbors," Proceedings of the IEEE International Conference on Big Data (Big Data), pp. 3897-3903, 2017.
[39] K. Huang, H. Jiang and X. Y. Zhang, "Field Support Vector Machines," Journal of the IEEE Transactions on Emerging Topics in Computational Intelligence, Vol. 1, No. 6, pp. 454-463, 2017.
[40] C. Chang and C. Lin, "LIBSVM: A Library for Support Vector Machines," Journal of ACM transactions on intelligent systems and technology (TIST), Vol. 2, No. 3, pp. 27:1-27:27, 2011.
[41] M. A. U. H. Tahir, S. Asghar, A. Zafar and S. Gillani, "A Hybrid Model to Detect Phishing-Sites Using Supervised Learning Algorithms," Proceedings of the International Conference on Computational Science and Computational Intelligence (CSCI), pp. 1126-1133, 2016.
[42] Z. H. Zhou, "Ensemble Methods: Foundations and Algorithms," Chapman & Hall/CRC, pp. 1-234, 2012.
[43] V. Ramanathan and H. Wechsler, "Phishing Website Detection Using Latent Dirichlet Allocation and AdaBoost," Proceedings of the IEEE International Conference on Intelligence and Security Informatics, pp. 102-107, 2012.
[44] A.Y. Daeef, R.B. Ahmad, Y. Yacob and N.Y. Phing, "Wide Scope and Fast Websites Phishing Detection Using URLs Lexical Features," Proceedings of the International Conference on Electronic Design, pp.410-415, 2016.
[45] Netscape Communications Corporation. Open directory rdf dump. (http://rdf.dmoz.org/)
[46] H. Sutrisno and S. Halim, "Credit Scoring Refinement Using Optimized Logistic Regression," Proceedings of the International Conference on Soft Computing, Intelligent System and Information Technology (ICSIIT), pp. 26-31, 2017.
[47] R. Verma and K. Dyer, "On the Character of Phishing URLs: Accurate and Robust Statistical Learning Classifiers," Proceedings of the 5th ACM Conference on Data and Application Security and Privacy, pp. 111-122, 2015.
[48] D.P. Kingma and J. Ba, "Adam: A Method for Stochastic Optimization," Journal of CoRR, Vol. abs/1412.6980, pp. 1-15, 2015.
[49] H. Sak, A. Senior and F. Beaufays, "Long Short-Term Memory Recurrent Neural Network Architectures for Large Scale Acoustic Modeling," Proceedings of the Fifteenth Annual Conference of the International Speech Communication Association, pp.1-5, 2014.
[50] H. Kim, H. Nam, W. Jung and J. Lee, "Performance Analysis of CNN Frameworks for GPUs," Proceedings of the IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS), pp. 55-64, 2017.
[51] A. Radford, L. Metz and S. Chintala, "Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks," Journal of CoRR, Vol. abs/1511.06434, pp. 1-16, 2016.
[52] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. Vanhoucke and A. Rabinovich, "Going Deeper with Convolutions," Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1-9, 2015.
[53] W. Zhang, Q. Jiang, L. Chen and C. Li, "Two-Stage ELM for Phishing Web Pages Detection Using Hybrid Features," Journal of World Wide Web Journal, Vol. 20, No. 4, pp.797-813, 2016.
[54] P.J.G Laencina, "Improving Predictions Using Linear Combination of Multiple Extreme Learning Machines," Journal of Information Technology and Control, Vol. 42, No. 1, pp. 86-93, 2013.
[55] J.J. Cao, S. Kwong, R. Wang and K. Li, "A Weighted Voting Method Using Minimum Square Error Based on Extreme Learning Machine," Proceedings of International Conference on Machine Learning and Cybernetics, pp. 411-414, 2012.
[56] 壹讀, 選擇支持向量機(SVM)核函數(https://read01.com/Qan5g7.html#.WtWxuy65thE)
[57] T. Chen and C. Guestrin, "XGBoost: A Scalable Tree Boosting System," Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 785-794, 2016.
[58] D. E. Rumelhart, G. E. Hinton and R. J. Williams, "Learning Representations by Back-Propagating Errors," Journal of Nature, Vol. 323, No. 6088, pp. 533-536, 1986.
[59] S. Hochreiter and J. Schmidhuber, "Long Short-Term Memory," Journal of Neural Computation, Vol. 9, No. 8, pp. 1735-1780, 1997.
[60] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, "Generative Adversarial Nets," Proceedings of the NIPS, pp. 2672-2680, 2014.
[61] P. Baldi, "Autoencoders, Unsupervised Learning, and Deep Architectures," Proceedings of ICML Workshop on Unsupervised and Transfer Learning, pp. 37-49, 2012.
[62] Oversampling and undersampling in data analysis. (https://en.wikipedia.org/wiki/Oversampling_and_undersampling_in_data_analysis)
[63] Z. Zheng, Y. Cai and Y. Li, "Oversampling Method for Imbalanced Classification," Journal of the Computing and informatics, Vol. 34, No. 5, pp. 1017-1037, 2016.
[64] H. Han, W. Y. Wang and B. H. Mao, "Borderline-SMOTE: A New Over-Sampling Method in Imbalanced Data Sets Learning," Proceedings of the international conference on Advances in Intelligent Computing, pp. 878-887, 2005.
[65] H. He, Y. Bai, E. A. Garcia and S. Li, "ADASYN: Adaptive Synthetic Sampling Approach for Imbalanced Learning," Proceedings of the IEEE International Joint Conference on Neural Networks, pp. 1322-1328, 2008.
[66] L. Bottou, "Large-Scale Machine Learning with Stochastic Gradient Descent," Proceedings of COMPSTAT'2010, pp.177-186, 2010.
[67] I. Sutskever, J. Martens, G. Dahl and Geoffrey Hinton, "On the Importance of Initialization and Momentum in Deep Learning," Proceedings of the 30th International Conference on International Conference on Machine Learning, Vol. 28, pp. 1139-1147, 2013.
[68] W. Su, L. Chen, M. Wu, M. Zhou, Z. Liu and W. Cao, "Nesterov Accelerated Gradient Descent-Based Convolution Neural Network with Dropout for Facial Expression Recognition," Proceedings of Asian Control Conference (ASCC), pp. 1063-1068, 2017.
[69] E. YAZAN and M. F. Talu, "Comparison of the Stochastic Gradient Descent Based Optimization Techniques," Proceedings of International Artificial Intelligence and Data Processing Symposium (IDAP), pp. 1-5, 2017.
[70] M. D. Zeiler, "Adadelta: An Adaptive Learning Rate Method," Journal of CoRR, Vol. abs/1212.5701, pp. 1-6, 2012.
[71] Y. N. Dauphin, H. D. Vries, J. Chung and Y. Bengio, "RMSProp and Equilibrated Adaptive Learning Rates for Non-Convex Optimization," Journal of CoRR, Vol. abs/1502.04390, pp. 1-10, 2015.
[72] B. Anderson and D. McGrew, "Identifying Encrypted Malware Traffic with Contextual Flow Data," Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35-46, 2016.
[73] B. Anderson and D. McGrew, " Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity," Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1723-1732, 2017.