Encrypted Network Traffic Classification Using Deep and Parallel Network-In-Network Models

Abstract

Network traffic classification analyzes received data packets to identify distinct application or traffic kinds. This research describes a neural network model that uses deep and parallel network-in-network (NIN) architectures to classify encrypted network data. In comparison to typical convolutional neural networks (CNN), NIN uses a micro network after each convolution layer to improve local modeling. Furthermore, NIN uses global average pooling instead of traditional fully connected layers before final classification, resulting in a considerable reduction in the number of model parameters. Our suggested solution uses deep NIN models with several MLP convolutional layers to map fixed-length packet vectors to application or traffic labels. Furthermore, a parallel decision method is created to build two sub-networks to process packet headers and packet bodies separately, taking into account that they may include different types of evidence for classification. Our investigations on the ''ISCX VPN-nonVPN'' encrypted traffic dataset demonstrate that NIN models can achieve a better balance between classification accuracy and model complexity than standard CNNs. The parallel decision technique can increase the accuracy of a single NIN model for classifying encrypted network data. Finally, the test set F1 scores of 0.983 and 0.985 are obtained for traffic characterisation and application identification, respectively