MEMG: Mobile Encrypted Traffic Classification With Markov Chains and Graph Neural Network

Abstract

In recent years, user privacy and information Security have attracted widespread attention, encryption ratio of mobile traffic has increased tremendously, which has brought considerable challenges to traditional traffic classification meth-ods. Machine learning methods and deep learning methods have become mainstream methods to solve this problem. However, the existing machine learning methods require manual features and cannot adapt to the newly generated traffic patterns. Deep learning methods are capable of learning features from the raw traffic sequences automatically but will increase the calculation costs. To address these challenges, in this paper, we propose a Mobile Encrypted Traffic Classification with Markov Chains and Graph Neural Network (MEMG). We use the Markov chains to mine the hidden topological information of the flow. Then we build the flow graph structure on this basis, add the sequence information of traffic in the node feature in the graph. We also design a Graph Neural Network-based classifier to learn the topological and sequential features from the graph. The classifier can map the graph structure to the embedding space, and classify different graph structures by embedding vector differences. We have done comprehensive experiments on both the real-world dataset and the public dataset. The real-world dataset contains the traffic of 29 commonly used mobile encrypted applications collected by us recently, and the total number of traffic exceeds 116,000. Our method outperforms the state-of-the-art methods by 6.1% and 3.5% of the accuracy rate on our dataset and public dataset, respectively. We also lessen the training time overhead and GPU memory usage by 40% and 46%, respectively.