A Session-Packets-Based Encrypted Traffic Classification Using Capsule Neural Networks

Abstract

With the enhancement of network security awareness and excellent applicability of encryption protocols, identifying encrypted traffic is a critical and fundamental task for many network protection applications. Conventional port-based and deep packet inspection (DPI) approaches can't classify encrypted traffic effectively. Recent studies show that the approaches based on machine learning especially deep learning are effective for the task. However, these studies ignore the feature attributes of traffic like the location of fixed strings and change the effective features behind the traffic. In this paper, we propose a novel session-packets-based encrypted network traffic classification model using capsule neural networks (CapsNet), called SPCaps. The SPCaps introduces a twice-segmentation mechanism to dilute the interference traffic and increase the weight of effective traffic. And then it learns the spatial characteristics of encrypted traffic using CapsNet and outputs the results of encrypted traffic classification by a softmax classifier. We evaluate the proposed model for encrypted traffic classification in terms of service and application on publicly available ISCX VPN-nonVPN dataset. The experimental results demonstrate that SPCaps outperforms the state-of-the-art encrypted traffic classification approaches.