{"id":"https://openalex.org/W4409261487","doi":"https://doi.org/10.1109/tce.2025.3558353","title":"HyperEye: A Lightweight Features Fusion Model for Unknown Encrypted Malware Traffic Detection","display_name":"HyperEye: A Lightweight Features Fusion Model for Unknown Encrypted Malware Traffic Detection","publication_year":2025,"publication_date":"2025-04-08","ids":{"openalex":"https://openalex.org/W4409261487","doi":"https://doi.org/10.1109/tce.2025.3558353"},"language":"en","primary_location":{"id":"doi:10.1109/tce.2025.3558353","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tce.2025.3558353","pdf_url":null,"source":{"id":"https://openalex.org/S126824455","display_name":"IEEE Transactions on Consumer Electronics","issn_l":"0098-3063","issn":["0098-3063","1558-4127"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Consumer Electronics","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5090713660","display_name":"Xiaodong Zang","orcid":"https://orcid.org/0000-0002-8377-5877"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaodong Zang","raw_affiliation_strings":["School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","School of Cyber Science and Engineering, QuFu Normal University, QuFu, China"],"raw_orcid":"https://orcid.org/0000-0002-8377-5877","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","institution_ids":["https://openalex.org/I202126657"]},{"raw_affiliation_string":"School of Cyber Science and Engineering, QuFu Normal University, QuFu, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056521090","display_name":"Zilong Zheng","orcid":"https://orcid.org/0000-0003-1219-5151"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zilong Zheng","raw_affiliation_strings":["School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","School of Cyber Science and Engineering, QuFu Normal University, QuFu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","institution_ids":["https://openalex.org/I202126657"]},{"raw_affiliation_string":"School of Cyber Science and Engineering, QuFu Normal University, QuFu, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064920196","display_name":"Haosheng Zheng","orcid":null},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haosheng Zheng","raw_affiliation_strings":["School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","School of Cyber Science and Engineering, QuFu Normal University, QuFu, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Qufu Normal University, Qufu, China","institution_ids":["https://openalex.org/I202126657"]},{"raw_affiliation_string":"School of Cyber Science and Engineering, QuFu Normal University, QuFu, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100362330","display_name":"Xuan Liu","orcid":"https://orcid.org/0000-0002-7966-4488"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuan Liu","raw_affiliation_strings":["College of Information Engineering (College of Artificial Intelligence), Yangzhou University, Yangzhou, China","College of Artificial Intelligence, College of Information Engineering, Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-7966-4488","affiliations":[{"raw_affiliation_string":"College of Information Engineering (College of Artificial Intelligence), Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]},{"raw_affiliation_string":"College of Artificial Intelligence, College of Information Engineering, Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072011650","display_name":"Muhammad Khurram Khan","orcid":"https://orcid.org/0000-0001-6636-0533"},"institutions":[{"id":"https://openalex.org/I28022161","display_name":"King Saud University","ror":"https://ror.org/02f81g417","country_code":"SA","type":"education","lineage":["https://openalex.org/I28022161"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Muhammad Khurram Khan","raw_affiliation_strings":["Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia","Center of Excellence in Information Assurance, King Saud University, Kingdom of Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-6636-0533","affiliations":[{"raw_affiliation_string":"Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I28022161"]},{"raw_affiliation_string":"Center of Excellence in Information Assurance, King Saud University, Kingdom of Saudi Arabia","institution_ids":["https://openalex.org/I28022161"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100756528","display_name":"Weiwei Jiang","orcid":"https://orcid.org/0000-0003-0953-5047"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiwei Jiang","raw_affiliation_strings":["School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0953-5047","affiliations":[{"raw_affiliation_string":"School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":9.5338,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":{"value":0.98113869,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"71","issue":"2","first_page":"5079","last_page":"5089"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.989799976348877,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.687465488910675},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6352266073226929},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.6233421564102173},{"id":"https://openalex.org/keywords/fusion","display_name":"Fusion","score":0.4886227250099182},{"id":"https://openalex.org/keywords/sensor-fusion","display_name":"Sensor fusion","score":0.4476347863674164},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.36597636342048645},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.34664756059646606},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3248751759529114},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.29231923818588257}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.687465488910675},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6352266073226929},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.6233421564102173},{"id":"https://openalex.org/C158525013","wikidata":"https://www.wikidata.org/wiki/Q2593739","display_name":"Fusion","level":2,"score":0.4886227250099182},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.4476347863674164},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36597636342048645},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.34664756059646606},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3248751759529114},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29231923818588257},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tce.2025.3558353","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tce.2025.3558353","pdf_url":null,"source":{"id":"https://openalex.org/S126824455","display_name":"IEEE Transactions on Consumer Electronics","issn_l":"0098-3063","issn":["0098-3063","1558-4127"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Consumer Electronics","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.4399999976158142,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G3442647037","display_name":null,"funder_award_id":"RSP2025R12","funder_id":"https://openalex.org/F4320321145","funder_display_name":"King Saud University"}],"funders":[{"id":"https://openalex.org/F4320321145","display_name":"King Saud University","ror":"https://ror.org/02f81g417"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W2273944394","https://openalex.org/W2282377910","https://openalex.org/W2900853407","https://openalex.org/W2912711574","https://openalex.org/W2967001080","https://openalex.org/W2976836186","https://openalex.org/W2982739679","https://openalex.org/W3103625270","https://openalex.org/W3119781401","https://openalex.org/W3121886859","https://openalex.org/W3190670750","https://openalex.org/W3217253123","https://openalex.org/W4200347975","https://openalex.org/W4206342677","https://openalex.org/W4243494487","https://openalex.org/W4283068901","https://openalex.org/W4296596384","https://openalex.org/W4306406279","https://openalex.org/W4313704048","https://openalex.org/W4320883109","https://openalex.org/W4321019788","https://openalex.org/W4323349687","https://openalex.org/W4378895217","https://openalex.org/W4379054627","https://openalex.org/W4382865033","https://openalex.org/W4387011225","https://openalex.org/W4388440662","https://openalex.org/W4388483517","https://openalex.org/W4389152158","https://openalex.org/W4389328382","https://openalex.org/W4391947395","https://openalex.org/W4392939489"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W2132659060","https://openalex.org/W2031992971","https://openalex.org/W3214791684","https://openalex.org/W2152662039"],"abstract_inverted_index":{"Recently,":[0],"effectively":[1],"identifying":[2,99],"encrypted":[3,32,42],"malicious":[4,43,100],"traffic":[5,16,44,51,57,79],"without":[6],"decryption":[7],"in":[8,98,125],"consumer":[9,145],"applications":[10,146],"relies":[11],"heavily":[12],"on":[13],"high-quality":[14],"labeled":[15],"datasets.":[17],"However,":[18],"this":[19],"harms":[20],"models":[21],"for":[22],"incorrect":[23],"labeling":[24],"and":[25,65,69,96,107,147,152],"requires":[26],"more":[27],"efficient":[28],"real-time":[29],"identification":[30],"of":[31,144],"unknown":[33,50],"ones.":[34],"This":[35],"paper":[36],"proposes":[37],"HyperEye,":[38],"a":[39,71,77,84],"real-time,":[40],"unsupervised,":[41],"detection":[45,118],"system.":[46],"It":[47],"can":[48,148],"detect":[49],"patterns":[52],"by":[53],"analyzing":[54],"the":[55,94,126,132,141],"fused":[56],"features":[58,68],"in-depth.":[59],"Precisely,":[60],"we":[61],"extract":[62],"protocol-agnostic":[63],"numerical":[64],"protocol-specific":[66],"text":[67],"devise":[70],"cross-term":[72],"fusion":[73],"algorithm":[74,91],"to":[75,92,140],"obtain":[76],"comprehensive":[78],"behavior":[80],"description.":[81],"We":[82],"designed":[83],"genetic":[85],"algorithm-based":[86],"DBSCAN":[87],"(GA-DBSCAN)":[88],"parameter":[89],"optimization":[90],"enhance":[93],"quality":[95],"stability":[97],"traffic.":[101],"Extensive":[102],"experimental":[103,129],"results":[104,130],"with":[105,131],"open-world":[106],"real-world":[108,133],"datasets":[109],"demonstrate":[110,135],"that":[111,136],"our":[112,137],"work":[113],"outperforms":[114],"other":[115],"state-of-the-art":[116],"malware":[117],"systems,":[119],"achieving":[120],"an":[121],"average":[122],"11.95%":[123],"improvement":[124],"F1-score.":[127],"Besides,":[128],"dataset":[134],"system":[138],"applies":[139],"dynamic":[142],"nature":[143],"safeguard":[149],"users\u2019":[150],"data":[151],"privacy.":[153]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":10}],"updated_date":"2026-07-25T15:57:00.446498","created_date":"2025-10-10T00:00:00"}