k-NN Classification of Malware in HTTPS Traffic Using the Metric Space Approach

Abstrakt

In this paper, we present detection of malware in HTTPS traffic using k-NN classification. We focus on the metric space approach for approximate k-NN searches over dataset of sparse high-dimensional descriptors of network traffic.

We show the classification based on approximate k-NN search using metric index exhibits false positive rate reduced by an order of magnitude when compared to the state of the art method, while keeping the classification fast enough.

Klíčová slova

• Similarity search
• k-NN classification
• Intrusion detection