Article Details

Abstract

To address the issue that existing Deep Learning-based methods for malicious traffic detection in railway networks overlook non-uniform temporal intervals between data packets when introducing natural language processing techniques, this paper proposes a time-interval rotary positional encoding method. This method integrates packet timestamps into the rotation angles of rotary positional encoding through normalization, logarithmic binning, and learnable parameter modulation, enabling the Transformer model to perceive real time intervals between packets. On this basis, this paper constructs a malicious traffic detection model named TDRoPE-MS and establishes a scenario dataset, RW-Malware&Normal, containing four typical network attacks. Experimental results show that the proposed model achieves an accuracy of 98.5% on the CIC-IDS2017 dataset, outperforming the ViT baseline by 0.6 percentage points, and attains an F1-score of 98.6% on the imbalanced ISOT dataset. This method resolves the mismatch between the equidistant-sequence assumption and the non-uniform temporal characteristics of network traffic, improves detection accuracy, and provides a new approach to railway network security protection.

Keywords

cybersecurity; malicious traffic detection; Deep Learning; temporal-aware encoding

References

1. [1] Dainotti A，Pescape A，Claffy K C. Issues and Future Directions in Traffic Classification [J].IEEE Network，2012，26（1）：35-40.
2. [2] Qi Y，Xu L，Yang B，et al. Packet Classification Algorithms: From Theory to Practice [C]//IEEE INFOCOM 2009，2009：648-656.
3. [3] Wang Yuanfan, Shi Yong, Xue Zhi Research on Port Scanning Malicious Traffic Detection Based on Decision Tree [J]. Communication Technology, 2020, 53 (8): 2002-2005
4. [4] Yamansavascilar B，Guvensan MA，Yavuz AG，et al. Application Identification via Network Traffic Classification [C]//2017 International Conference on Computing, Networking and Communications (ICNC)，2017：843-848.
5. [5] Wang W，Zhu M，Zeng X W，et al. Malware Traffic Classification Using Convolutional Neural Network for Representation Learning [C]//2017 International Conference on Information Networking (ICOIN)，2017：712-717.
6. [6] Guo Santian, Liu Yi A Network Intrusion Detection Method Combining Type Balance and CNN [J]. Computer Applications and Software, 2023, 40 (7): 326-332
7. [7] Zhang Rui Intrusion Detection Model Based on Convolutional Neural Network for Connected Vehicles [J]. Telecommunication Science, 2024, 40 (12): 51-62
8. [8] Gong Xingyu, source, Li Na, etc Network intrusion detection model based on multi-scale fusion and spatiotemporal features [J]. Computer Engineering and Design, 2024, 45 (6): 1640-1646
9. [9] Liu S Q，Han Y N，Hu Y J，et al. FA-net: Attention-based Fusion Network For Malware HTTPs Traffic Classification [C]//2021 IEEE Symposium on Computers and Communications (ISCC)，2021：1-7.
10. [10] Lin X J，Xiong G，Gou G P，et al. ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification [C]//Proceedings of the ACM Web Conference 2022，2022：633-642.
11. [11] Jin Yanliang, Chen Yantao, Gao Yuan, etc Encryption traffic classification based on attention time convolutional network [J]. Chinese Journal of Applied Sciences, 2024, 42 (4): 659-672
12. [12] Vaswani A，Shazeer N，Parmar N，et al. Attention Is All You Need [J/OL].arXiv:1706.03762 [cs.CL].https://doi.org/10.48550/arXiv.1706.03762.
13. [13] Xie G R，Li Q，Jiang Y，et al. SAM: Self-Attention based Deep Learning Method for Online Traffic Classification [C]/NetAI '20: Proceedings of the Workshop on Network Meets AI & ML，2020：14-20.
14. [14] Raffel C， Shazeer N，Roberts A，et al. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer [J].Journal of Machine Learning Research，2020，21（140）：1-67.
15. [15] Liu Jingyu Research on Malicious Traffic Detection Technology Based on Bit Alignment and Relative Delay Position Encoding [D]. Zhengzhou: Zhengzhou University, 2024
16. [16] Marín G，Caasas P，Capdehourat G. DeepMAL - Deep Learning Models for Malware Traffic Detection and Classification [C]//Proceedings of the 3rd International Data Science Conference-iDSC2020，2021：105-112.
17. [17] Liu Z，Xie Y Y，Luo Y Y，et al. TransECA-Net: A Transformer-Based Model for Encrypted Traffic Classification [J/OL].Applied Sciences，2025，15（6）：2977.https://doi.org/10.3390/app15062977.
18. [18] Machmeier S，Hoecker M，Heuveline V. Explainable Artificial Intelligence for Improving a Session-Based Malware Traffic Classification with Deep Learning [C]//2023 IEEE Symposium Series on Computational Intelligence (SSCI)，2023：850-855.

Funding

Basic Research Funds for Central Universities (2025TJJBKY031)

About the authors

Liu Jingyu (1996-), male, Han ethnicity, from Zhengzhou, Henan Province, China, teaching assistant, master's student, research direction: network security, artificial intelligence.