Abstract: With the rapid development of information technology in the field of industrial control, the industrial Internet has become a major target for cyberattacks, making malicious traffic detection increasingly important. However, the widespread use of encryption allows attackers to easily hide malicious communication content, rendering traditional contentbased detection methods ineffective. This paper proposes an encrypted malicious traffic detection scheme based on a hybrid neural network and domain adaptation. The scheme integrates ResNet, ResNext, DenseNet, and similarity detection algorithms to construct a hybrid neural network. On this basis, a domain adaptation module is added to reduce data bias. By preprocessing streams from a public industrial Internet dataset, deep features are extracted from encrypted traffic without decryption. The hybrid neural network outputs higherdimensional feature vectors that leverage the strengths of each model. A domain classifier within the domain adaptation module enhances the model’s stability and generalization across different network environments and time periods, enabling accurate classification of malicious traffic. Experimental results show that the proposed scheme improves accuracy and efficiency in detecting encrypted malicious traffic.

Key words: industrial Internet, hybrid neural network, encrypted malicious traffic, similarity detection, domain adaptation

摘要： 随着信息化技术在工控领域的快速发展，工业互联网逐渐成为网络攻击的重要目标，恶意流量检测显得尤为重要.然而，加密技术的普及使得攻击者可以轻松隐藏恶意通信内容，传统基于内容分析的流量检测方法已难以有效应对.提出一种基于混合神经网络和域适应的加密恶意流量检测方案，融合ResNet网络、ResNext网络、DenseNet网络和相似度检测算法构建混合神经网络.在此基础上，加入域适应模块减少数据的偏差.通过对工业互联网公共数据集进行流预处理，在勿需解密流量的情况下从加密流量中提取深层次特征，使用混合神经网络输出一组充分利用各模型特长的更高维特征向量，随后采用域适应模块中的域分类器提升模型在不同的网络环境和时间段的稳定性和泛化能力.实验结果表明，提出的方案在加密恶意流量检测任务上表现出较好的性能和效率，提高了加密恶意流量检测的准确性.

关键词: 工业互联网, 混合神经网络, 加密恶意流量, 相似度检测, 域适应