MAAN: A Multiple Attribute Association Network for Mobile Encrypted Traffic Classification

Abstract

With the rapid development of mobile applications and the rising concern over user privacy, cryptographic protocols, especially Secure Socket Layer/Transport Layer Security (SSL/TLS), are widely used on the Internet. Many networking and security services call for application-level encrypted traffic classification before conducting related policies. Exiting methods exhibit unsatisfying accuracy using the partial handshake information or only the flow-level features. In this paper, we propose a novel encrypted traffic classification method named Multiple Attribute Associate Network (MAAN). MAAN is a unified model that automatically extracts features from handshake messages and flows. Moreover, the MAAN has acceptable time consumption and is suitable to apply in real-time scenarios. Our experiments demonstrate that the MAAN achieves \(98.2\%\) accuracy on a real-word dataset (including 59k+ SSL sessions and covering 16 applications) and outperforms the state-of-the-art methods.