Interaction matters: Encrypted traffic classification via status-based interactive behavior graph

Abstract

Accurately classifying encrypted traffic is the indispensable cornerstone for network management and Quality of Service (QoS) improvement. Although existing works that learn from non-interaction features of communication behavior have achieved a satisfactory performance, there still remains an unsolved crux before practical application that current works fail to distinguish different encrypted traffic generated by the same application. Such similar but distinct traffic is widely-existed since applications typically employ similar communication settings and encryption technology for diverse data transmission. To address the above issues, this work proposes that interaction features of communication behavior provide substantial information in terms of traffic classification, while directly leveraging such diversiform interaction information is non-trivial. As a solution, we devise a novel graph structure preserving the information of interactive process, referred to interactive behavior graph, to represent communication behaviors. Specifically, the proposed interactive behavior graph respectively stores the transition status and interaction status of the interactive actions during the interactive process in the edges and vertices with attributes. In addition, a classification model is tailored based on sampling subgraphs, which capture communication behavior patterns from the strong interaction correlation among neighboring interactive actions. Comprehensive experimental results demonstrate the superiority of our method over solid comparisons. Particularly, in distinguishing similar encrypted traffic, our method achieves an accuracy rate exceeding 98%, which outperforms the state-of-the-art methods. Furthermore, we validate the generalizability of our proposed method on two well-known encrypted traffic datasets, attaining an accuracy rate of 94%.