[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-123357-en":3,"doc-seo-123357-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},123357,962075114765,"Quinn","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Network Encryption Traffic Anomaly Detection Based on Integrated Machine Learning","This paper presents an anomaly detection method for encrypted network traffic using integrated machine learning. A stream feature extraction technique derives key indicators from encrypted traffic, including packet and byte median values, contrast measures, port growth rate, and source IP growth rate. These features are fed into a combined model that integrates a collaborative neural network with a random forest classifier. An improved Bagging fusion strategy uses weighted summation to identify anomalous characteristics. Experiments on the Trace dataset show high precision and zero false positives across multiple attack scenarios, supporting robust protection for encrypted communication channels.","ISSN 1330-3651 (Print), ISSN 1848-6339 (Online) [https://doi.org/10.17559/TV-20240223001345](https://doi.org/10.17559/TV-20240223001345)  \nOriginal scientific paper  \nNetwork Encryption Traffic Anomaly Detection Based on Integrated Machine Learning  \nXiaoqing YANG*, Niwat ANGKAWISITTPAN  \nAbstract: This paper presents an anomaly detection method for encrypted network traffic using integrated machine learning. A stream feature extraction technique is employed to extract key features such as the median value of stream packets, median value of stream bytes, contrast stream, port growth rate, and source IP growth rate from the encrypted traffic. These features are then fed into an anomaly detection model that combines a collaborative neural network and a random forest classifier. An improved Bagging method is used to fuse and identify the anomalous characteristics of the encrypted traffic by weighted summation. Experimental results using the Trace dataset demonstrate that the proposed method achieves high precision and zero false positives in detecting various types of anomalies under different attack scenarios. The proposed approach offers a promising solution for ensuring network security and protecting against threats in encrypted communication channels.  \nKeywords: anomaly detection; flow characteristics; improved Bagging method; integrated; machine learning; network encryption traffic  \n1 INTRODUCTION  \nThe rapid development of new technologies, such as cloud computing, Internet of Things and blockchain, has led to great changes in network traffic patterns and characteristics [1] . These new technologies are highly dependent on the network, which makes the network security issue more important [2] . The increasing popularity of cloud services has also brought new challenges to network security. As a new computing model, cloud computing has greatly promoted the process of enterprise and individual information construction by providing flexible and extensible computing resources. However, with the wide application of cloud services, cloud security issues have become increasingly prominent. Cloud service providers need to ensure the security and privacy of user data, and at the same time deal with threats from various network attacks. The surge of Internet of Things devices is a remarkable trend in recent years. With the improvement of network conditions and the popularization of Internet applications, the number of Internet of Things devices has experienced explosive growth. These devices are connected with each other through the Internet, forming a huge network, which makes data collection, transmission and processing more convenient. However, with the increasing number of Internet of Things devices, network security issues have become increasingly prominent. Because IOT devices usually have low computing power and storage capacity, and often lack professional security protection measures, they are vulnerable to various network attacks. The widespread use of mobile applications also brings new challenges to network security. Mobile applications have become an indispensable part of people's daily life, and they provide various convenient services and functions. However, with the increasing number of mobile applications, security issues have become increasingly prominent. Some malicious software or viruses will pretend to be normal applications and attack by stealing user information and destroying system stability. Therefore, the encryption traffic anomaly detection technology is constantly updated and developed to meet the challenges brought by new technologies and applications [3]. In order to protect the privacy of users, more and more network traffic is encrypted. This makes it difficult for  \ntraditional traffic analysis methods to effectively detect and identify abnormal traffic. Therefore, it is necessary to develop anomaly detection technology specifically for encrypted traffic.  \nIt can be seen from relevant research m","cbCaimrlN0stYFLr","https://ap.wps.com/l/cbCaimrlN0stYFLr","pdf",547716,1,10,"English","en",105,"# Introduction\n## Background: emerging technologies and security challenges\n## Prior work and limitations\n### DDoS detection with machine learning\n### Entropy-based vulnerability detection\n### Keyword-matching traffic classification","[{\"question\":\"What technique is used to extract features from encrypted traffic?\",\"answer\":\"The method uses stream feature extraction to compute indicators such as packet/byte median values, contrast stream, port growth rate, and source IP growth rate.\"},{\"question\":\"How is the anomaly detection model structured?\",\"answer\":\"It combines a collaborative neural network with a random forest classifier, then applies an improved Bagging fusion using weighted summation.\"},{\"question\":\"How did the proposed approach perform in experiments?\",\"answer\":\"Experiments on the Trace dataset achieved high precision and zero false positives across various anomaly types under different attack scenarios.\"}]","Network Encryption Traffic Anomaly Detection Based on Integrated Machine Learning | PDF",1785816106,25,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"network-encryption-traffic-anomaly-detection-based-on-integrated-machine-learning","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/network-encryption-traffic-anomaly-detection-based-on-integrated-machine-learning/123357/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What technique is used to extract features from encrypted traffic?","Question",{"text":75,"@type":76},"The method uses stream feature extraction to compute indicators such as packet/byte median values, contrast stream, port growth rate, and source IP growth rate.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How is the anomaly detection model structured?",{"text":80,"@type":76},"It combines a collaborative neural network with a random forest classifier, then applies an improved Bagging fusion using weighted summation.",{"name":82,"@type":73,"acceptedAnswer":83},"How did the proposed approach perform in experiments?",{"text":84,"@type":76},"Experiments on the Trace dataset achieved high precision and zero false positives across various anomaly types under different attack scenarios.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]