{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T00:34:14Z","timestamp":1781656454920,"version":"3.54.5"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031976285","type":"print"},{"value":"9783031976292","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-97629-2_19","type":"book-chapter","created":{"date-parts":[[2025,7,4]],"date-time":"2025-07-04T06:31:00Z","timestamp":1751610660000},"page":"265-280","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Encrypted Malicious Traffic Detection Using Multi-instance Learning"],"prefix":"10.1007","author":[{"given":"Ziwei","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiangyi","family":"Yin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhao","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiangchao","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Meijie","family":"Du","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhongyi","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qingyun","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,7,5]]},"reference":[{"key":"19_CR1","unstructured":"Althouse, J.: TLS fingerprinting with JA3 and JA3S (2019). https:\/\/engineering.salesforce.com\/tls-fingerprinting-with-ja3-and-ja3s-247362855967. Accessed 28 Feb 2025"},{"key":"19_CR2","doi-asserted-by":"crossref","unstructured":"Anderson, B., McGrew, D.: Identifying encrypted malware traffic with contextual flow data. In: Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35\u201346 (2016)","DOI":"10.1145\/2996758.2996768"},{"key":"19_CR3","doi-asserted-by":"crossref","unstructured":"Bahramali, A., Soltani, R., Houmansadr, A., Goeckel, D., Towsley, D.: Practical traffic analysis attacks on secure messaging applications. arXiv preprint arXiv:2005.00508 (2020)","DOI":"10.14722\/ndss.2020.24347"},{"key":"19_CR4","unstructured":"Bro, P.V.: A system for detecting network intruders in real-time. In: Proceedings of the 7th USENIX Security Symposium (1998)"},{"key":"19_CR5","doi-asserted-by":"publisher","first-page":"329","DOI":"10.1016\/j.patcog.2017.10.009","volume":"77","author":"MA Carbonneau","year":"2018","unstructured":"Carbonneau, M.A., Cheplygina, V., Granger, E., Gagnon, G.: Multiple instance learning: a survey of problem characteristics and applications. Pattern Recogn. 77, 329\u2013353 (2018)","journal-title":"Pattern Recogn."},{"key":"19_CR6","unstructured":"Cimpanu, C.: NOPEN is the equation group\u2019s backdoor for Unix systems (2022)"},{"key":"19_CR7","unstructured":"Duncan, B.: Malware-traffic-analysis.net (2024). https:\/\/malware-traffic-analysis.net. Accessed 28 Feb 2025"},{"key":"19_CR8","doi-asserted-by":"crossref","unstructured":"Fu, C., Li, Q., Shen, M., Xu, K.: Detecting tunneled flooding traffic via deep semantic analysis of packet length patterns. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 3659\u20133673 (2024)","DOI":"10.1145\/3658644.3670353"},{"key":"19_CR9","doi-asserted-by":"crossref","unstructured":"Fu, C., Li, Q., Xu, K.: Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis. arXiv preprint arXiv:2301.13686 (2023)","DOI":"10.14722\/ndss.2023.23080"},{"key":"19_CR10","doi-asserted-by":"crossref","unstructured":"Fu, Z., et al.: Encrypted malware traffic detection via graph-based network analysis. In: Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, pp. 495\u2013509 (2022)","DOI":"10.1145\/3545948.3545983"},{"key":"19_CR11","unstructured":"Gallagher, S.: Nearly half of malware now use TLS to conceal communications. Sophos news (2021)"},{"key":"19_CR12","doi-asserted-by":"publisher","first-page":"179","DOI":"10.1016\/j.cose.2019.03.013","volume":"84","author":"A Gezer","year":"2019","unstructured":"Gezer, A., Warner, G., Wilson, C., Shrestha, P.: A flow-based approach for TrickBot banking trojan detection. Comput. Secur. 84, 179\u2013192 (2019)","journal-title":"Comput. Secur."},{"issue":"9","key":"19_CR13","doi-asserted-by":"publisher","first-page":"398","DOI":"10.3390\/a17090398","volume":"17","author":"Y He","year":"2024","unstructured":"He, Y., Huang, P., Hong, W., Luo, Q., Li, L., Tsui, K.L.: In-depth insights into the application of recurrent neural networks (RNNs) in traffic prediction: a comprehensive review. Algorithms 17(9), 398 (2024)","journal-title":"Algorithms"},{"key":"19_CR14","doi-asserted-by":"publisher","first-page":"119229","DOI":"10.1016\/j.ins.2023.119229","volume":"644","author":"Y Hong","year":"2023","unstructured":"Hong, Y., Li, Q., Yang, Y., Shen, M.: Graph based encrypted malicious traffic detection with hybrid analysis of multi-view features. Inf. Sci. 644, 119229 (2023)","journal-title":"Inf. Sci."},{"issue":"2","key":"19_CR15","doi-asserted-by":"publisher","first-page":"1467","DOI":"10.1109\/TNSM.2023.3322152","volume":"21","author":"X Jiang","year":"2023","unstructured":"Jiang, X., Zhang, H.R., Zhou, Y.: Multi-granularity abnormal traffic detection based on multi-instance learning. IEEE Trans. Netw. Serv. Manage. 21(2), 1467\u20131477 (2023)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"issue":"3","key":"19_CR16","doi-asserted-by":"publisher","first-page":"1385","DOI":"10.1109\/TNET.2022.3216603","volume":"31","author":"W Li","year":"2022","unstructured":"Li, W., Zhang, X.Y., Bao, H., Shi, H., Wang, Q.: ProGraph: robust network traffic identification with graph propagation. IEEE\/ACM Trans. Netw. 31(3), 1385\u20131399 (2022)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"19_CR17","doi-asserted-by":"crossref","unstructured":"Liu, C., He, L., Xiong, G., Cao, Z., Li, Z.: FS-net: a flow sequence network for encrypted traffic classification. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1171\u20131179. IEEE (2019)","DOI":"10.1109\/INFOCOM.2019.8737507"},{"issue":"1","key":"19_CR18","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1007\/s10922-021-09634-4","volume":"30","author":"S Mahdavifar","year":"2022","unstructured":"Mahdavifar, S., Alhadidi, D., Ghorbani, A.A.: Effective and efficient hybrid android malware classification using pseudo-label stacked auto-encoder. J. Netw. Syst. Manage. 30(1), 22 (2022)","journal-title":"J. Netw. Syst. Manage."},{"key":"19_CR19","doi-asserted-by":"crossref","unstructured":"Mahdavifar, S., Kadir, A.F.A., Fatemi, R., Alhadidi, D., Ghorbani, A.A.: Dynamic android malware category classification using semi-supervised deep learning. In: 2020 IEEE International Conference on Dependable, Autonomic and Secure Computing, International Conference on Pervasive Intelligence and Computing, International Conference on Cloud and Big Data Computing, International Conference on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), pp. 515\u2013522. IEEE (2020)","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094"},{"key":"19_CR20","doi-asserted-by":"crossref","unstructured":"Mimura, M., Otsubo, Y., Tanaka, H., Tanaka, H.: A practical experiment of the http-based rat detection method in proxy server logs. In: 2017 12th Asia Joint Conference on Information Security (AsiaJCIS), pp. 31\u201337. IEEE (2017)","DOI":"10.1109\/AsiaJCIS.2017.13"},{"key":"19_CR21","doi-asserted-by":"crossref","unstructured":"Nasr, M., Bahramali, A., Houmansadr, A.: DeepCorr: strong flow correlation attacks on tor using deep learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1962\u20131976 (2018)","DOI":"10.1145\/3243734.3243824"},{"key":"19_CR22","unstructured":"Nelms, T., Perdisci, R., Ahamad, M.: $$\\{$$ExecScent$$\\}$$: mining for new $$\\{$$C &C$$\\}$$ domains in live networks with adaptive control protocol templates. In: 22nd USENIX Security Symposium (USENIX Security 13), pp. 589\u2013604 (2013)"},{"key":"19_CR23","doi-asserted-by":"crossref","unstructured":"Rescorla, E.: The transport layer security (TLS) protocol version 1.3. Technical report, Internet Engineering Task Force (IETF) (2018)","DOI":"10.17487\/RFC8446"},{"key":"19_CR24","unstructured":"Roesch, M., et\u00a0al.: Snort: lightweight intrusion detection for networks. In: Lisa, pp. 229\u2013238 (1999)"},{"issue":"10","key":"19_CR25","doi-asserted-by":"publisher","first-page":"3078","DOI":"10.3390\/s24103078","volume":"24","author":"G Wang","year":"2024","unstructured":"Wang, G., Gu, Y.: Multi-task scenario encrypted traffic classification and parameter analysis. Sensors 24(10), 3078 (2024)","journal-title":"Sensors"},{"key":"19_CR26","doi-asserted-by":"publisher","first-page":"37004","DOI":"10.1109\/ACCESS.2019.2905041","volume":"7","author":"Y Zhang","year":"2019","unstructured":"Zhang, Y., Chen, X., Jin, L., Wang, X., Guo, D.: Network intrusion detection: based on deep hierarchical network and original flow data. IEEE Access 7, 37004\u201337016 (2019)","journal-title":"IEEE Access"}],"container-title":["Lecture Notes in Computer Science","Computational Science \u2013 ICCS 2025"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-97629-2_19","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T06:55:36Z","timestamp":1777532136000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-97629-2_19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031976285","9783031976292"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-97629-2_19","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"5 July 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICCS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Computational Science","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Singapore","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Singapore","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"7 July 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 July 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccs-computsci2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.iccs-meeting.org\/iccs2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}