k-NN Classification of Malware in HTTPS Traffic Using the Metric Space Approach

Abstract

In this paper, we present detection of malware in HTTPS traffic using k-NN classification. We focus on the metric space approach for approximate k-NN searches over dataset of sparse high-dimensional descriptors of network traffic.

We show the classification based on approximate k-NN search using metric index exhibits false positive rate reduced by an order of magnitude when compared to the state of the art method, while keeping the classification fast enough.

Keywords

• Similarity search
• k-NN classification
• Intrusion detection