ILETC: Incremental learning for encrypted traffic classification using generative replay and exemplar

Abstract

With the constant updating of applications and the emergence of various encryption technologies, it is important to achieve continuous learning of encrypted traffic. Traditional encrypted traffic classification techniques can only handle a fixed number of traffic classes and require all traffic data to be available at the same time, which consume a huge amount of memory to save the traffic data. In this paper, we propose an incremental learning method for encrypted traffic classification, called ILETC, to achieve continuous learning of encrypted traffic. ILETC can learn new encrypted traffic classes while avoiding forgetting knowledge of old encrypted traffic, with limited memory resources. It uses WGAN-GP to model the data distribution of encrypted traffic and design an exemplar set to select and store representative real traffic data. When learning from a new class of encrypted traffic, ILETC replays the knowledge of the old classes with the generated samples and exemplars to mitigate catastrophic forgetting. The ISCX VPN-nonVPN dataset and self-collected dataset are used to test the performance of ILETC. The results show that ILETC is superior to the state-of-the-art methods with an accuracy of over 98% on the ISCX dataset and over 94% in the two datasets together.