Encrypted Traffic Classification Research Articles

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis.

The widespread use of encrypted traffic poses challenges to network management and network security. Traditional machine learning-based methods for encrypted traffic classification no longer meet the demands of management and security. The application of deep learning technology in encrypted traffic classification significantly improves the accuracy of models. This study focuses primarily on encrypted traffic classification in the fields of network analysis and network security. To address the shortcomings of existing deep learning-based encrypted traffic classification methods in terms of computational memory consumption and interpretability, we introduce a Parameter-Efficient Fine-Tuning method for efficiently tuning the parameters of an encrypted traffic classification model. Experimentation is conducted on various classification scenarios, including Tor traffic service classification and malicious traffic classification, using multiple public datasets. Fair comparisons are made with state-of-the-art deep learning model architectures. The results indicate that the proposed method significantly reduces the scale of fine-tuning parameters and computational resource usage while achieving performance comparable to that of the existing best models. Furthermore, we interpret the learning mechanism of encrypted traffic representation in the pre-training model by analyzing the parameters and structure of the model. This comparison validates the hypothesis that the model exhibits hierarchical structure, clear organization, and distinct features.

The art of time-bending: Data augmentation and early prediction for efficient traffic classification

The accurate identification of internet traffic is crucial for network management. However, the use of encryption techniques and constant changes in network protocols make it difficult to extract useful features for traffic classification. Additionally, there may be limited data availability and a lack of diversity within the dataset, which poses further challenges. To address these issues, our research proposes a novel solution that uses an innovative data augmentation technique. This approach leverages the capabilities of LSTM networks to create synthetic data points that closely resemble real traffic data. By doing so, we can significantly enrich the dataset used for training and improve classification efficiency. We conducted thorough experiments to validate our approach and found that combining LSTM-generated data with actual traffic data leads to notable improvements in classification efficiency. We demonstrated the effectiveness of our methodology using academic and commercial datasets. Our classifier, trained on the generated data, showed a performance boost of 6%. Moreover, when classifying with only half of the time, thus utilizing half of the signal, our approach achieved a notable 4% improvement compared to the original classifier. The inclusion of augmented samples within the training set led to a noticeable improvement in both accuracy and F1-score. These findings compellingly demonstrate our data augmentation strategy’s practical utility and efficiency in earlier prediction with improved performance for encrypted traffic classification systems.

CETP: A novel semi-supervised framework based on contrastive pre-training for imbalanced encrypted traffic classification

Encrypted traffic classification (ETC) requires differentiated and robust traffic representation captured from content-agnostic and imbalanced traffic data for accurate classification, which is challenging but indispensable for enabling network security and network management. Some existing deep-learning based ETC approaches have achieved promising results, but have limitations in real-world network environments: 1) label bias caused by traffic class imbalance and 2) traffic homogeneity due to component sharing. How to leverage open-domain unlabeled imbalanced traffic data to learn representation with strong generalization ability remains a key challenge. In this paper, we propose a novel imbalanced traffic representation model, called Contrastive Encrypted Traffic Pre-training (CETP), which pre-trains deep multi-granularity traffic representation from imbalanced data without directly using application labels. The pre-trained model can be further mitigated against label bias due to imbalance by semi-supervised continual fine-tuning via pseudo-label iterations and dynamic loss-weighting algorithms. CETP achieves state-of-the-art performance across four imbalanced encrypted traffic classification tasks, remarkably improving the F1 to 96.31% (2.74%↑) for CP-Android, 93.86% (3.58%↑) for CIC-2019, and 84.16% (10.19%↑) for ISCX-VPN. Meanwhile, we further validate the effectiveness of CETP in QUIC-based imbalanced encrypted traffic. Notably, we verify through analytical experiments that CETP not only effectively relieves label bias and homogeneous flow misclassification, but also extends to ETC methods with diverse feature extractors.

CoTNeT: Contextual transformer network for encrypted traffic classification

As network infrastructures continue to grow and traffic encryption technologies evolve at a rapid pace, the task of classifying encrypted traffic has become significantly more intricate. These emerging encryption methods render conventional approaches ineffectual in discerning traffic types, consequently posing novel challenges to network security and administration. Evidently, conventional traffic classification techniques are inadequate when it comes to encrypted traffic. Consequently, researchers have turned to machine learning and deep learning models to address this challenge, achieving remarkable results in this domain. Nonetheless, contemporary deep learning models exhibit a propensity to overly depend on self-attention mechanisms while processing 2D feature maps. This mechanism typically focuses only on individual query-key pairs, neglecting the rich contextual information among adjacent keys, thereby limiting their performance in encrypted traffic classification. To address this limitation, our study examines an innovative approach called CoTNet. The CoT module is integrated into the ResNet model to more comprehensively exploit the contextual associations among input keys. This innovation engenders a sturdier and more potent classification model, adept at comprehensively capturing the inherent patterns and correlated information within input features. The suggested method enhances the ResNet model by substituting the conventional 3x3 convolution operations with CoT modules, thereby more effectively harnessing the contextual associations among input keys. In particular, we integrate self-attention mechanisms at various model levels to more thoroughly capture the inherent patterns and correlated information within input features. Experimental results on two real-world datasets show that CoTNet outperforms multiple state-of-the-art methods in the encrypted traffic classification task.

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

AbstractOver the past decade, there has been a growing surge of interest in leveraging artificial intelligence and machine learning models to address real‐world challenges within the field of telecommunications and networking. Among these challenges, network traffic classification has consistently remained a key focal point within the community. The emergence of new paradigms such as internet of things has added complexity to this challenge, owing to the diverse array of traffic classes it introduces. This complexity is further compounded when dealing with encrypted traffic data. In the context of this paper, we employ explainable artificial intelligence (XAI) techniques to offer insightful explanations for the task of classifying encrypted network traffic. Our approach involves presenting a ranked list of the model's input features, organized based on their significance in influencing the classifier's predictions. These ranked lists shed light on the underlying functionality of the encrypted traffic classification model, enabling users to discern which features hold greater importance in shaping the model's output by harnessing the insights provided by XAI approaches. Moreover, we carry out a quantitative assessment and comparison of the results generated by these XAI methods and outputs of three other conventional, widely adopted feature selection approaches, utilizing them as feature selection techniques when applied to a convolutional neural network for classifying data from the CIC‐Darknet2020 and CIC‐IDS2017 datasets. The results show that XAI techniques have high performance in feature selection for network traffic classification.

DE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification

Nowadays, most network traffic is encrypted, which protects user privacy but complicates the task of analyzing and classifying encrypted traffic. Identifying the specific categories of encrypted traffic, such as application type or even the specific application, is of great significance for advanced network services and network security management. Many existing methods for encrypted traffic classification rely on machine learning and deep learning techniques, but they exhibit certain shortcomings. A considerable number of these methods rely on statistical features, which may lose their relevance as networks evolve and lead to the loss of important information. Additionally, Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) face limitations in extracting features from encrypted traffic, specifically, their inability to learn traffic interaction information within a network flow.To address these challenges, we propose a model called Dual Embedding with Graph Neural Networks (DE-GNN) for fine-grained encrypted traffic classification. Based on the byte-packet-flow structure of network traffic, we present a dual embedding layer that encodes the packet header and payload separately using raw bytes, which allows subsequent processes to run separately and in parallel. Then, we develop the PacketCNN to extract packet-level features from both the header and payload. Afterwards, we construct a network flow as a Traffic Interaction Graphs (TIG) and utilize Graph Neural Networks (GNNs) to extract flow-level features. Finally, an adaptive deep feature fusion process is applied to combine flow-level features from the header and payload, creating a robust representation for classification. Extensive experiments are conducted on two well-known datasets, ISCX-VPN2016 and ISCX-Tor2016, to verify our approach. The experimental results demonstrate that DE-GNN effectively identifies the type of encrypted traffic, outperforming baselines significantly.

Bidirectional Flow-Based Image Representation Method for Detecting Network Traffic Service Categories

Network traffic identification is crucial for network resource management and improving service quality. Traditional methods, such as port-based and deep packet inspection approaches, face challenges due to the increasing complexity of network environments, privacy concerns, and the emergence of encrypted traffic. This paper aims to address the issues of low accuracy and slow operation speed in encrypted traffic classification while ensuring the protection of user privacy. We propose a data processing method that transforms network traffic into images representing bidirectional flow packet arrival timestamps and packet sizes. By employing this data processing approach and utilizing deep recognition algorithms, the study conducts service analysis on network traffic. Experimental results demonstrate that the bidirectional flow-based image representation method achieves a 90.9% accuracy rate for the traffic analysis task on a TOR-encrypted imbalanced dataset, surpassing the accuracy of the unidirectional flow image method. Furthermore, the method also shows improvements in operation speed, enabling online network traffic detection.

Hybrid compression for LSTM-based encrypted traffic classification model

Hybrid compression for LSTM-based encrypted traffic classification model

I $^{2}$ RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

F3l: an automated and secure function-level low-overhead labeled encrypted traffic dataset construction method for IM in Android

Fine-grained function-level encrypted traffic classification is an essential approach to maintaining network security. Machine learning and deep learning have become mainstream methods to analyze traffic, and labeled dataset construction is the basis. Android occupies a huge share of the mobile operating system market. Instant Messaging (IM) applications are important tools for people communication. But such applications have complex functions which frequently switched, so it is difficult to obtain function-level labels. The existing function-level public datasets in Android are rare and noisy, leading to research stagnation. Most labeled samples are collected with WLAN devices, which cannot exclude the operating system background traffic. At the same time, other datasets need to obtain root permission or use scripts to simulate user behavior. These collecting methods either destroy the security of the mobile device or ignore the real operation features of users with coarse-grained. Previous work (Chen et al. in Appl Sci 12(22):11731, 2022) proposed a one-stop automated encrypted traffic labeled sample collection, construction, and correlation system, A3C, running at the application-level in Android. This paper analyzes the display characteristics of IM and proposes a function-level low-overhead labeled encrypted traffic datasets construction method for Android, F3L. The supplementary method to A3C monitors UI controls and layouts of the Android system in the foreground. It selects the feature fields of attributes of them for different in-app functions to build an in-app function label matching library for target applications and in-app functions. The deviation of timestamp between function invocation and label identification completion is calibrated to cut traffic samples and map them to corresponding labels. Experiments show that the method can match the correct label within 3 s after the user operation.

Retracted: CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Retracted: CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Let model keep evolving: Incremental learning for encrypted traffic classification

Encrypted Traffic Classification (ETC) is valuable for many network management and security solutions as it provides insights into applications active on the network. However, the network environment constantly evolves, and new applications emerge in an endless stream daily, which gradually makes well-trained ETC models ineffective. The conventional approach to adapting new applications is to re-train the models on a re-formed dataset with both pre-existing and new application samples. The major limitation is that requiring redundant computing resources and sufficient storage spaces. In this work, we propose an Incremental Learning (IL) framework based on multi-view sequences fusion, MISS, to keep ETC models evolving with new applications. The key novelty of MISS is three-fold: extract cross-view information from multi-view sequences to capture sufficient knowledge; propose an exemplar selection algorithm from communication patterns to reduce redundant consumption; design a pair of branches from the learnability of parameters to mitigate accuracy loss during evolution. MISS outperforms the existing IL methods of ETC, and the state-of-the-art ETC models using the classic IL framework, on the real-world network traffic datasets, which achieves satisfactory improvements of 11.37%↑ and 1.58%↑. Furthermore, we comprehensively perform incremental experiments to evaluate the evolution ability of MISS, which is able to select representative exemplars of old applications, counteract the adverse effects of homogeneous applications, and keep evolving with unknown applications.

OSF-EIMTC: An open-source framework for standardized encrypted internet traffic classification

Internet traffic classification plays a key role in network visibility, Quality of Services (QoS), intrusion detection, Quality of Experience (QoE) and traffic-trend analyses. In order to improve privacy, integrity, confidentiality, and protocol obfuscation, the current traffic is based on encryption protocols, e.g., SSL/TLS. With the increased use of Machine-Learning (ML) and Deep-Learning (DL) models in the literature, comparison between different models and methods has become cumbersome and difficult due to a lack of a standardized framework. In this paper, we propose an open-source framework, named OSF-EIMTC, which can provide the full pipeline of the learning process and simulation reproducibility. From well-known datasets to extracting new and well-known features, it provides implementations of well-known ML and DL models (from the traffic classification literature) as well as experimental test-beds and their evaluation. By providing a standardized platform, OSF-EIMTC enables repeatable, reproducible, and accurate comparisons of both established and novel features and models. As part of our framework evaluation, we demonstrate the reproducibility of a variety of cases where the framework can be of use, utilizing multiple datasets, models, and feature sets. We show analyses of publicly available datasets and invite the community to participate in our open challenges using OSF-EIMTC, fostering collaborative advancements in encrypted traffic classification.

Tabular-based self-supervised learning approach for encrypted traffic classification

Tabular-based self-supervised learning approach for encrypted traffic classification

Two-Stage Distillation-Aware Compressed Models for Traffic Classification

Traffic classification is indispensable for the Internet of Things (IoT) in intrusion detection and resource management. Deep learning (DL)-based strategies are the key tools for traffic classification due to high accuracy but still have some challenges. 1) It is hard to deploy complex DL models on resource-constraint IoT devices. 2) Performance is limited because of the ignorance of the similarity between IoT traffic. To address these issues, we propose lightweight but accurate models for traffic classification. First, we adopt a network-in-network basic model to reduce model size. Second, the basic model is trained with self-distilled response, feature map, and similarity among traffic types to enable its identification accuracy. Next, redundant filters are removed from the basic model to achieve compressed architectures. Then a teacher model updating scheme with knowledge distillation is proposed to train compressed models without compromising performance. Experimental results demonstrate that compared to the state-of-the-art deep packet model, the compressed model can achieve the highest accuracy, deal with imbalanced traffic, and reduce nearly 99% of computation overhead in two encrypted traffic classification scenarios, thus emphasizing its efficiency.

FastTraffic: A lightweight method for encrypted traffic fast classification

Nowadays, most Internet communications have adopted encrypted network access technology for privacy protection, so encrypted traffic classification (ETC) has become a crucial research point to support network management and ensure cyberspace security. Meanwhile, off-the-shelf deep learning (DL)-based approaches suffer from long preprocessing time, large input size, and a trade-off between model complexity and accuracy. There is a tough challenge to deploy them on mainstream network devices and achieve fast and accurate traffic classification. In this paper, we design FastTraffic, a lightweight DL-based method for ETC on low-configuration network devices. To speed up processing, we set an IP packet as the granularity of FastTraffic, truncate the informative parts in packets as inputs, and utilize a text-like packet tokenization method. For a lightweight and effective model, we propose an N-gram feature embedding method to represent structured and sequential features of packets and design a three-layer MLP to complete fast classification. We compare FastTraffic with eight state-of-the-art ETC methods on three public benchmark datasets. The experimental results show that FastTraffic obtains better classification performance than the other seven methods with only 0.43M model parameters. Besides, it can also achieve high throughput on low-configuration devices and consume a small amount of computing and storage resources. Therefore, FastTraffic is a lightweight ETC method capable of large-scale deployment on Internet devices.

A Novel Multimodal Deep Learning Framework for Encrypted Traffic Classification

Traffic classification is essential for cybersecurity maintenance and network management, and has been widely used in QoS (Quality of Service) guarantees, intrusion detection, and other tasks. Recently, with the emergence of SSL/TLS encryption protocols in the modern Internet environment, the traditional payload-based classification methods are no longer effective. Some researchers have used machine learning methods to model the flow features of encrypted traffics (e.g. message type, length sequence, statistical features, etc.), and achieved good results in some cases. However, these high-level hand-designed features cannot be used for more fine-grained operations and may lead to the loss of important information, thus affecting the classification accuracy. To overcome this limitation, in this paper, we designed a novel multimodal deep learning framework for encrypted traffic classification called PEAN. PEAN uses the raw bytes and length sequence as the input, and uses the self-attention mechanism to learn the deep relationship among network packets in a biflow. Furthermore, unsupervised pre-training was introduced to enhance PEAN’s ability to characterize network packets. Experiments on a real trace set captured in a large data center demonstrate the effectiveness of PEAN, which achieves better results than the state-of-the-art methods.

IP packet-level encrypted traffic classification using machine learning with a light weight feature engineering method

As the importance of personal data privacy increases, traffic encryption has become an important topic in network communication. In the field of network security and management, the development of encrypted traffic classification technology has drawn attention to deep learning methods. For raw encrypted traffic, deep learning models can realize end-to-end classification with high accuracy. However, deep learning methods do not explain which part of the encrypted traffic is critical to classification, and that will limit their application in some cyber security scenarios that demand high interpretability. The approach proposed in this paper features a novel feature engineering method named “BITization” to determine the encoding method of features and a sliding window technique to explore which bytes contribute the most to the classification. The accuracy of classical machine learning methods in encrypted traffic is improved by at least 14.1% through the proposed feature engineering approach. In the experiments, the enhanced methods achieve a 98.6% average accuracy and a 98.5% average F1-score on the ISCX-VPN-Service, Cross-Platform-IOS, Cross-Platform-Android, and USTC-TFC2016 datasets, from which we believe a state-of-the-art performance is achieved.

Few-shot encrypted traffic classification via multi-task representation enhanced meta-learning

Encrypted traffic classification requires identifying the services and programs running behind the content-invisible traffic data for improving quality of service and providing security assurance. Mainstream solutions achieve reliable performance by training on large-scale datasets. However, with the continuous emergence and development of encryption services, collecting and labeling sufficient amounts of encrypted traffic becomes impractical. Therefore, it is critical to utilize the few labeled data for accurate encrypted traffic classification. In this paper, we propose a Multi-task Representation Enhanced Meta-learning model (MetaMRE) for few-shot encrypted traffic classification. Specifically, we design a flow discrepancy enhancement module that combines supervised learning and clustering-based unsupervised learning to boost the discrepancy of encrypted traffic representations from a few labeled data. Moreover, MetaMRE introduces a multi-task collaborative meta-learning module that makes full use of non-target task data to learn the optimal initialization parameters suitable for the encrypted traffic classification, and then only a small amount of labeled encrypted traffic is required to adapt to the target classification task. Extensive evaluations on various real-world datasets show that the MetaMRE outperforms existing state-of-the-art methods and copes well with version updates and cross-domain problems in encrypted traffic classification.

EETC: An extended encrypted traffic classification algorithm based on variant resnet network

With the advent of big data, encrypted traffic is widely used, and it is gradually becoming a new challenge for network security and management. Many researchers have obtained good results by converting encrypted traffic into images and feeding them to deep learning-based classification models. However, these methods have some limitations in that they cannot do sustainable learning. They have to retrain a new classifier when new traffic is encountered. To tackle this issue, we propose an extended encrypted traffic classification algorithm based on incremental learning. This approach extracts content and statistical information from encrypted traffic and supports multi-label prediction for VPN channels and applications. We can add new classes to the model without completely retraining and accelerate the update cycle of the model. The results show that the proposed model performs well in classification experiments, which can achieve 98.1% and 96.0% classification accuracy on ISCXVPN2016 and self-collected dataset respectively. In addition, our method can retain high accuracy under the situation of limited memory space while the number of new classes of data increases gradually. It demonstrates the superiority of constructing a generic unforgetting basis for classifying encrypted communication.