Sieve

Requirements

torch==2.1.1
numpy==1.26.1
scikit-learn==1.7.2
pandas==2.1.3
tqdm==4.67.1
matplotlib==3.8.2

Full dependencies: see requirements.txt

Datasets

MAL_TLS2023 dataset: https://github.com/gcx-Yuan/BoAu

DDoS2019 dataset: https://www.unb.ca/cic/datasets/ddos-2019.html

The preprocessing method for TLS traffic can be found in datasets/TLS_feature_extract.py

Using Sieve

1. Training (train.py)

Train the noise-resilient classifier on encrypted traffic data with mixed noisy labels.

python train.py \
    --dataset malicious_tls \
    --noisy_dataset TLS1.3 \
    --noise_ratio 0.5 \
    --open_ratio 0.5 \
    --noise_mode sym \
    --epochs 100 \
    --batch_size 256 \
    --lr 0.001

2. Unknown Traffic Detection (unknown_traffic_detect.py)

Detect unknown/OOD traffic using the trained model with Mahalanobis distance-based scoring.

python unknown_traffic_detect.py \
    --dataset malicious_tls \
    --noisy_dataset TLS1.3 \
    --noise_ratio 0.5 \
    --open_ratio 0.5

3. Unknown Traffic Labeling (Unknown_Traffic_Labeling/)

Label detected unknown traffic using semi-supervised clustering.

Step 1: Save OOD samples

cd Unknown_Traffic_Labeling

python save_ood_samples.py \
    --dataset malicious_tls \
    --noisy_dataset TLS1.3 \
    --noise_ratio 0.1 \
    --open_ratio 0.5

Step 2: Run GCD pipeline

python run_gcd_pipeline.py \
    --dataset malicious_tls \
    --noisy_dataset TLS1.3 \
    --noise_ratio 0.1 \
    --open_ratio 0.5 \
    --max_K 100

Evaluation Metrics:

• AKS: Accuracy on Known/Seen classes
• ANS: Accuracy on Novel/Seen classes
• HCA: Harmonic Clustering Accuracy
• NMI: Normalized Mutual Information
• ARI: Adjusted Rand Index

Project Structure

Sieve/
├── train.py                      # Training script
├── unknown_traffic_detect.py     # Unknown traffic detection
├── Unknown_Traffic_Labeling/     # Unknown traffic labeling module
│   ├── save_ood_samples.py
│   ├── run_gcd_pipeline.py
│   └── novel_category_discovery.py
├── models/
│   └── preresnet.py              # DeepResNet model
├── datasets/
│   └── dataloader_tls.py         # Data loading utilities
├── utils/                        # Utility functions
├── logs/                         # Training logs and checkpoints
└── cache/                        # Dataset cache files