Abstract
The wide application of encryption technology has made traffic classification gradually become a major challenge in the field of network security. Traditional methods such as machine learning, which rely heavily on feature engineering and others, can no longer fully meet the needs of encrypted traffic classification. Therefore, we propose an Inception-LSTM(ICLSTM) traffic classification method in this paper to achieve encrypted traffic service identification. This method converts traffic data into common gray images, and then uses the constructed ICLSTM neural network to extract key features and perform effective traffic classification. To alleviate the problem of category imbalance, different weight parameters are set for each category separately in the training phase to make it more symmetrical for different categories of encrypted traffic, and the identification effect is more balanced and reasonable. The method is validated on the public ISCX 2016 dataset, and the results of five classification experiments show that the accuracy of the method exceeds 98% for both regular encrypted traffic service identification and VPN encrypted traffic service identification. At the same time, this deep learning-based classification method also greatly simplifies the difficulty of traffic feature extraction work.
Highlights
In recent years, traffic encryption has been widely used on the Internet due to advanced encryption technology
Based on the above analysis, we propose a new deep learning model for encrypted traffic service identification—a neural network structure based on the Inception module [10] in parallel and Long Short Term Memory (LSTM) module
The mixed encrypted traffic service identification has the problem of insufficient training stability, we believe that because the VPN encrypted traffic and regular encrypted traffic are affected by the encryption protocol which are differences, it causes the service identification performance of each application to vary greatly
Summary
Traffic encryption has been widely used on the Internet due to advanced encryption technology. Gartner estimated that more than 80% of enterprise network traffic was encrypted by 2019, and 94% of Google network traffic was encrypted by May 2019. The identification and classification of encrypted traffic have received a lot of attention from academia and industry [2]. Neural networks (NNs) are networks consisting of a large number of interconnected artificial neurons. These networks are usually composed of a large number of building blocks called neurons, which represent a specific output function, called the activation function. We will briefly review the two most important deep neural networks used in our proposed network traffic classification scheme, named the Inception module and the LSTM module
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
