ISCX VPN-nonVPN Research Articles

A real-time network traffic classification system using cost-sensitive deep neural networks

Due to the continuous growth of Internet and online applications, network traffic classification is not only becoming one of the most crucial disciplines in network management but is also becoming quintessential for providing advanced tasks such as Quality of Service and network security. Moreover, even though many studies have been undertaken in recent years, real-time encrypted traffic classification continues to be an important challenge in the field of network traffic classification. Therefore, in this paper a real-time network traffic classification system is proposed together with five new models. The real-time classification system classified each incoming real-time packets into appropriate classes of interest and the five new models make use of a cost-sensitive learning strategy to deal with the unbalanced data problem during the training phase. The proposed models, which are called Cost-Sensitive Long-Short Term Memory (CSLSTM), Cost-Sensitive Gated Recurrent Unit (CSGRU), Cost-Sensitive Convolution Neural Network (CSCNN), CSNN with LSTM and CSCNN with GRU, can handle both traffic categorization and application identification. These proposed models were compared with prominent methods in this field and the proposed CSCNN was observed to outperform the researched deep learning models by at least 4% to 16% in correctly classifying packets from the ISCX VPN-nonVPN dataset.

A novel approach for application classification with encrypted traffic using BERT and packet headers

Recent years have seen substantial advancements in Internet technology along with environmental changes, which have led to the emergence of various security issues. There is also a trend of explosive growth in applications that encrypt network traffic for various types of services. Therefore, the classification of applications within encrypted traffic represents an important research issue for both secure network management and efficient bandwidth management. In such encrypted traffic, the payload itself is encrypted, and it is no longer viable to classify applications based on signatures extracted from plaintext. Most applications in public datasets for encrypted traffic classification are collected with the same IP address and port number, which makes the 5-tuple information a strong identifier. However, this 5-tuple contains many characteristics related to both the traffic collection environment and user-specific traits, rather than intrinsic features of the applications themselves. Therefore, when addressing the problem of encrypted traffic application classification, it is advisable to utilize header information excluding the 5-tuple and payload. Therefore, this paper proposes a novel service type and application classification system based on the Bidirectional Encoding Representation Transformer (BERT), which utilizes packet header information from encrypted traffic. The proposed system ensures the accuracy and generalization performance of the classification model by using only the header information from traffic packets, excluding the 5-tuple and payload. Further, to preserve the characteristics and semantic meaning of an encrypted traffic packet, sentences embedded with 2-byte tokens were used as input for BERT. The proposed system was designed to exclude labeling information from all sentences during the pre-training phase before proceeding with training. Fine-tuning was then conducted to align the system with the objectives of the service type and application classification. This experiment utilized the publicly available ISCX VPN-nonVPN dataset, and the proposed model achieved remarkable accuracy in the key performance measure, i.e., F1-scores, with values of 99.24 % in service type classification and 98.74 % in application classification. This capability can be used in maintaining the confidentiality of encrypted traffic, network security monitoring, Quality of Service (QoS), and traffic management in complex IT environments.

Encrypted Network Traffic Classification Using Deep and Parallel Network-In-Network Models

Network traffic classification analyzes received data packets to identify distinct application or traffic kinds. This research describes a neural network model that uses deep and parallel network-in-network (NIN) architectures to classify encrypted network data. In comparison to typical convolutional neural networks (CNN), NIN uses a micro network after each convolution layer to improve local modeling. Furthermore, NIN uses global average pooling instead of traditional fully connected layers before final classification, resulting in a considerable reduction in the number of model parameters. Our suggested solution uses deep NIN models with several MLP convolutional layers to map fixed-length packet vectors to application or traffic labels. Furthermore, a parallel decision method is created to build two sub-networks to process packet headers and packet bodies separately, taking into account that they may include different types of evidence for classification. Our investigations on the ''ISCX VPN-nonVPN'' encrypted traffic dataset demonstrate that NIN models can achieve a better balance between classification accuracy and model complexity than standard CNNs. The parallel decision technique can increase the accuracy of a single NIN model for classifying encrypted network data. Finally, the test set F1 scores of 0.983 and 0.985 are obtained for traffic characterisation and application identification, respectively

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

The demand for encrypted communication is increasing with the continuous development of secure and trustworthy networks. In edge computing scenarios, the requirement for data processing security is becoming increasingly high. Therefore, the accurate identification of encrypted traffic has become a prerequisite to ensure edge intelligent device security. Currently, encrypted network traffic classification relies on single-feature extraction methods. These methods have simple feature extraction, making distinguishing encrypted network data flows and designing compelling manual features challenging. This leads to low accuracy in multi-classification tasks involving encrypted network traffic. This paper proposes a hybrid deep learning model for multi-classification tasks to address this issue based on the synergy of dilated convolution and gating unit mechanisms. The model comprises a Gated Dilated Convolution (GDC) module and a CA-LSTM module. The GDC module completes the spatial feature extraction of encrypted network traffic through dilated convolution and gating unit mechanisms. In contrast, the CA-LSTM module focuses on extracting temporal network traffic features. By employing a collaborative approach to extract spatio-temporal features, the model ensures feature extraction diversity, guarantees robustness, and effectively enhances the feature extraction rate. We evaluate our multi-classification model using the ISCX VPN-nonVPN public dataset. Experimental results show that the proposed method achieves an accuracy rate of over 95% and a recall rate of over 90%, significantly outperforming existing methods.

An encrypted traffic identification method based on multi-scale feature fusion

As data privacy issues become more and more sensitive, increasing numbers of websites usually encrypt traffic when transmitting it. This method can largely protect privacy, but it also brings a huge challenge. Aiming at the problem that encrypted traffic classification makes it difficult to obtain a global optimal solution, this paper proposes an encrypted traffic identification model called the ET-BERT and 1D-CNN fusion network (BCFNet), based on multi-scale feature fusion. This method combines feature learning with classification tasks, unified into an end-to-end model. The local features of encrypted traffic extracted based on the improved Inception one-dimensional convolutional neural network structure are fused with the global features extracted by the ET-BERT model. The one-dimensional convolutional neural network is more suitable for the encrypted traffic of a one-dimensional sequence than the commonly used two-dimensional convolutional neural network. The proposed model can learn the nonlinear relationship between the input data and the expected label and obtain the global optimal solution with a greater probability. This paper verifies the ISCX VPN-nonVPN dataset and compares the results of the BCFNet model with the other five baseline models on accuracy, precision, recall, and F1 indicators. The experimental results demonstrate that the BCFNet model has a greater overall effect than the other five models. Its accuracy can reach 98.88%.

CMTSNN: A Deep Learning Model for Multiclassification of Abnormal and Encrypted Traffic of Internet of Things

With the increasing types and number of IoT devices and malicious programs and the popularization of encryption technology in the communication process between the internet and the Internet of Things (IoT), a large amount of encrypted abnormal traffic among devices endangers IoT cybersecurity. How to identify abnormal encrypted traffic of the IoT has become the premise of cybersecurity. Presently, most of the detection methods for traffic in the IoT have problems such as simple dataset processing, imperfect feature extraction, data imbalance, and low multi-classification accuracy. In this paper, we propose a multi-classification deep learning model named the cost matrix time-space neural network (CMTSNN) for abnormal and encrypted IoT traffic. The CMTSNN is divided into three parts. The first part is the preprocessing stage of the dataset, which needs to retain the timing relation between two data packets in the stream and create a cost penalty matrix according to the sample distribution. Aimed at the robustness of feature extraction in network flow, the second part extracts time series features and then space features to ensure the robustness of feature extraction. The third part is aimed at the problem of data imbalance. The cost penalty matrix is applied to the cost penalty layer in the training process, and then the improved cross-entropy loss function is used to calculate the loss to improve the classification accuracy of minority categories and increase the overall multi-classification performance of the model. Experiments were carried out with the ToN-IoT, BoT-IoT and ISCX VPN-NonVPN datasets. Compared with current methods, the proposed method shows better performances, including accuracy, precision, recall, F1 Score and false alarm rate.

Improving Performance, Reliability, and Feasibility in Multimodal Multitask Traffic Classification with XAI

The promise of Deep Learning (DL) in solving hard problems such as network Traffic Classification (TC) is being held back by the severe lack of transparency and explainability of this kind of approaches. To cope with this strongly felt issue, the field of eXplainable Artificial Intelligence (XAI) has been recently founded, and is providing effective techniques and approaches. Accordingly, in this work we investigate interpretability via XAIbased techniques to understand and improve the behavior of state-of-the-art multimodal and multitask DL traffic classifiers. Using a publicly available security-related dataset (ISCX VPNNONVPN), we explore and exploit XAI techniques to characterize the considered classifiers providing global interpretations (rather than sample-based ones), and define a novel classifier, DISTILLER-EVOLVED, optimized along three objectives: performance, reliability, feasibility. The proposed methodology proves as highly appealing, allowing to much simplify the architecture to get faster training time and shorter classification time, as fewer packets must be collected. This is at the expenses of negligible (or even positive) impact on classification performance, while understanding and controlling the interplay between inputs, model complexity, performance, and reliability.

ILETC: Incremental learning for encrypted traffic classification using generative replay and exemplar

With the constant updating of applications and the emergence of various encryption technologies, it is important to achieve continuous learning of encrypted traffic. Traditional encrypted traffic classification techniques can only handle a fixed number of traffic classes and require all traffic data to be available at the same time, which consume a huge amount of memory to save the traffic data. In this paper, we propose an incremental learning method for encrypted traffic classification, called ILETC, to achieve continuous learning of encrypted traffic. ILETC can learn new encrypted traffic classes while avoiding forgetting knowledge of old encrypted traffic, with limited memory resources. It uses WGAN-GP to model the data distribution of encrypted traffic and design an exemplar set to select and store representative real traffic data. When learning from a new class of encrypted traffic, ILETC replays the knowledge of the old classes with the generated samples and exemplars to mitigate catastrophic forgetting. The ISCX VPN-nonVPN dataset and self-collected dataset are used to test the performance of ILETC. The results show that ILETC is superior to the state-of-the-art methods with an accuracy of over 98% on the ISCX dataset and over 94% in the two datasets together.

RFSE-GRU: Data Balanced Classification Model for Mobile Encrypted Traffic in Big Data Environment

With the widespread use of mobile technologies and the Internet, traffic in mobile networks is increasing. This situation has made the classification of traffic an important element for data security and network management. However, encryption of traffic in modern networks makes it difficult to classify traffic with traditional methods. In this study, a unique deep learning-based classification model is proposed for the classification of encrypted mobile traffic data. The proposed model is a classification model called RFSE-GRU, which combines the Gated Recurrent Units (GRU) algorithm, feature selection and data balancing. The features that are more meaningful in the classification process are determined by selecting the features with the Random Forest algorithm. In addition, Synthetic Minority Oversampling Technique (SMOTE) oversampling algorithm and Edited Nearest Neighbor (ENN) undersampling algorithm were used together to reduce the negative impact of data imbalance on classification performance. The study was carried out on Apache Spark big data platform in Google Colab environment. In the study, ISCX VPN-Non VPN and UTMobileNet2021 datasets were used. Binary and multiclass classifications were made for the ISCX VPN-Non VPN dataset, and multiclass classifications were made for the UTMobileNet2021 dataset by using various algorithms on the datasets. The proposed model has been compared with eleven different algorithms and hybrid methods. At the same time, the effect of data balancing and feature selection on classification performance is examined. As a result, the proposed model achieved 93.91%, 82.68% and 96.83% accuracy rates in ISCX VPN-Non VPN binary and multiclass, UTMobileNet2021 multiclass classifications, respectively.

MTC: A Multi-Task Model for Encrypted Network Traffic Classification Based on Transformer and 1D-CNN

Traffic characterization (e.g., chat, video) and application identification (e.g., FTP, Facebook) are two of the more crucial jobs in encrypted network traffic classification. These two activities are typically carried out separately by existing systems using separate models, significantly adding to the difficulty of network administration. Convolutional Neural Network (CNN) and Transformer are deep learning-based approaches for network traffic classification. CNN is good at extracting local features while ignoring long-distance information from the network traffic sequence, and Transformer can capture long-distance feature dependencies while ignoring local details. Based on these characteristics, a multi-task learning model that combines Transformer and 1D-CNN for encrypted traffic classification is proposed (MTC). In order to make up for the Transformer’s lack of local detail feature extraction capability and the 1D-CNN’s shortcoming of ignoring long-distance correlation information when processing traffic sequences, the model uses a parallel structure to fuse the features generated by the Transformer block and the 1D-CNN block with each other using a feature fusion block. This structure improved the representation of traffic features by both blocks and allows the model to perform well with both long and short length sequences. The model simultaneously handles multiple tasks, which lowers the cost of training. Experiments reveal that on the ISCX VPN-nonVPN dataset, the model achieves an average F1 score of 98.25% and an average recall of 98.30% for the task of identifying applications, and an average F1 score of 97.94%, and an average recall of 97.54% for the task of traffic characterization. When advanced models on the same dataset are chosen for comparison, the model produces the best results. To prove the generalization, we applied MTC to CICIDS2017 dataset, and our model also achieved good results.

Only Header: a reliable encrypted traffic classification framework without privacy risk

Encrypted traffic classification plays a critical role in network management, providing appropriate Quality-of-Service and Network Intrusion Detection. Conventional port-based and deep packet inspection approaches cannot classify encrypted traffic effectively. Methods based on machine learning can classify encrypted traffic by extracting statistical features of the flow. However, they require manual extraction of features. Recent studies show that the approaches based on deep learning are compelling for the task. They can automatically learn raw traffic features without manual feature extraction. However, these studies still take the payload of encrypted traffic as the model input, which may cause privacy risks. Besides, a massive encrypted payload causes great storage pressure on traffic classification. In this paper, we propose a reliable encrypted traffic classification framework by only using the flow header called Only Header, which avoids privacy risks and achieves lightweight storage. Firstly, we introduce a twice segmentation mechanism to dilute the interference traffic and increase the weight of effective traffic. Then, we use capsule neural networks (CapsNet) to learn spatial and byte features of the flow header. The Only Header’s effectiveness is compared with other methods using two public datasets, including ISCX VPN-nonVPN and ISCX Tor-nonTor datasets. The experimental results demonstrate that the Only Header outperforms the state-of-the-art encrypted traffic classification methods.

GRAIN: Granular multi-label encrypted traffic classification using classifier chain

Granular traffic classification categorizes traffic into detailed classes like application names and services. Application names represent parent applications, such as Facebook, while application services are the individual actions within the parent application, such as Facebook-comment. These granular classes are still insufficient to keep pace with modern applications that offer various services. Accordingly, this paper further divides the application service class into inter-application and intra-application services to provide more insights. Inter-application service refers to a similar service between different parent applications, such as Facebook-comment and Youtube-comment, whereas intra-application service differentiates services within the same parent application, such as Facebook-comment and Facebook-post. Most studies focus on classification at the application name and inter-application service levels. In contrast, classification at the intra-application service level receives far less attention due to its complexity despite providing the highest flexibility. Therefore, this paper presents GRAIN, a granular multi-label approach to classify encrypted traffic at all three levels of granular classification: application name, inter-application and intra-application service levels using a classifier chain. GRAIN chains two random forest classifiers to produce a multi-label classification using seven novel statistical features based on packet payload length. The utilized features are independent of the packet payload content, thus unaffected by packet encryption and preserving user privacy. Our performance evaluation showed that GRAIN achieved an average F-measure of 99% at the application name level, 93% at the inter-application service level and 88% at the intra-application service level. To test for robustness, we compared GRAIN against four baseline classifiers and the ISCX VPN-nonVPN public dataset in which GRAIN maintained its comparable performance across all tests.

A Cost-Sensitive Deep Learning-Based Approach for Network Traffic Classification

Network traffic classification (NTC) plays an important role in cyber security and network performance, for example in intrusion detection and facilitating a higher quality of service. However, due to the unbalanced nature of traffic datasets, NTC can be extremely challenging and poor management can degrade classification performance. While existing NTC methods seek to re-balance data distribution through resampling strategies, such approaches are known to suffer from information loss, overfitting, and increased model complexity. To address these challenges, we propose a new cost-sensitive deep learning approach to increase the robustness of deep learning classifiers against the imbalanced class problem in NTC. First, the dataset is divided into different partitions, and a cost matrix is created for each partition by considering the data distribution. Then, the costs are applied to the cost function layer to penalize classification errors. In our approach, costs are diverse in each type of misclassification because the cost matrix is specifically generated for each partition. To determine its utility, we implement the proposed cost-sensitive learning method in two deep learning classifiers, namely: stacked autoencoder and convolution neural networks. Our experiments on the ISCX VPN-nonVPN dataset show that the proposed approach can obtain higher classification performance on low-frequency classes, in comparison to three other NTC methods.

Identification of Encrypted Traffic Through Attention Mechanism Based Long Short Term Memory

Network traffic classification has become an important part of network management, which is beneficial for achieving intelligent network operation and maintenance, enhancing the network quality of service (QoS), and for network security. Given the rapid development of various applications and protocols, more and more encrypted traffic has emerged in networks. Traditional traffic classification methods exhibited the unsatisfied performance since the encrypted traffic is no longer in plain text. In this work, we modeled the time-series network traffic by the recurrent neural network (RNN). Moreover, the attention mechanism was introduced for assisting network traffic classification in the form of the following two models, the attention aided long short term memory (LSTM) as well as the hierarchical attention network (HAN). Finally, relying on the ISCX VPN-NonVPN dataset, extensive experiments were conducted, showing that the proposed methods achieved 91.2 percent in accuracy while the highest accuracy of other methods was 89.8 percent relying on the same dataset.

A comparative study of deep learning and decision tree based ensemble learning algorithms for network traffic identification

In this paper, we apply Deep Learning (DL) and decision-tree-based ensemble learning algorithms to classify network traffic by application. Various Deep Learning (DL) models for network traffic identification have been presented, implemented and compared, including 1D convolutional, stacked autoencoder, multi-layer perceptron, and combination of the aforementioned. Then the results of DL models have been compared to those obtained with two popular ensemble learning models based on decision trees-Random Forest and XGBoost. To train and test the classification models, a dataset containing both encrypted and unencrypted traffic has been collected in a real network, under normal operating conditions, and pre-processed in a way that ensures non-biased results. The classification uncertainties of the models have been also quantified on publicly available ISCX VPN-nonVPN dataset. The models have been compared in terms of precision, recall, F1 score and accuracy, for different levels of complexity and training dataset sizes. The evaluation results indicate that the decision-tree ensemble learning algorithms provide more accurate results and outperform the DL algorithms. The performance gap reduces with the dataset complexity.

A new classification method for encrypted internet traffic using machine learning

The rate of internet usage in the world is over 62% and this rate is increasing day by day. With this increase, it becomes important to ensure the confidentiality of the information in the traffic flowing over the internet. Encryption algorithms and protocols are used for this purpose. This situation, which is beneficial for normal users, is also used by attackers to hide. Cyber attackers or hackers gain the ability to bypass security precautions such as IDS/IPS and antivirus systems with using encrypted traffic. Since payload analysis cannot be performed without deciphering the encrypted traffic, existing commercial security solutions fall short in this situation. In this study, it is aimed to classify the network traffic by analysing the outgoing and incoming data over the encrypted traffic using extreme gradient boosting (XGBoost), decision tree and random forest classification methods. Thus, without deciphering, it is possible to classify packets passing through encrypted traffic using some metadata like size and duration and to take precautions against attacks. ISCX VPN-NonVPN dataset was used to test the proposed model in this study. With the created framework, encrypted traffic was classified with a high success rate and 94.53% success was achieved by using the XGBoost classification method.

Encrypted Network Traffic Classification Using Deep and Parallel Network-in-Network Models

Network traffic classification aims to recognize different application or traffic types by analyzing received data packets. This paper presents a neural network model with deep and parallel network-in-network (NIN) structures for classifying encrypted network traffic. Comparing with standard convolutional neural networks (CNN), NIN adopts a micro network after each convolution layer to enhance local modeling. Besides, NIN utilizes a global average pooling instead of traditional fully connected layers before final classification, which reduces the number of model parameters significantly. In our proposed method, deep NIN models with multiple MLP convolutional layers are built to map fixed-length packet vectors towards application or traffic labels. Furthermore, a parallel decision strategy of building two sub-networks to process packet header and packet body separately is designed considering that they may carry different kinds of clues for classification. The results of our experiments on the “ISCX VPN-nonVPN” encrypted traffic dataset show that NIN models can achieve a better balance between classification accuracy and model complexity than conventional CNNs. The parallel decision strategy can further improve the accuracy of using single NIN model for encrypted network traffic classification. Finally, the test set F1 scores of 0.983 and 0.985 are achieved for traffic characterization and application identification respectively.

Semi-Supervised Encrypted Traffic Classification With Deep Convolutional Generative Adversarial Networks

Network traffic classification serves as a building block for important tasks such as security and quality of service management. The field has been studied for a long time, with many techniques such as classical machine learning and deep learning methods currently available. However, the emergence of stronger encryption protocols has led to the rise of new challenges. One of the challenges is capturing and labeling a large amount of encrypted traffic data especially for training deep learning classifiers, as current techniques rely on deep packet inspection tools (DPI) which perform poorly on encrypted traffic. In this paper, we propose a semi-supervised learning approach using Deep Convolutional Generative Adversarial Network (DCGAN). The basic idea is to utilize the samples generated by DCGAN generators as well as unlabeled data to improve the performance of a classifier trained on a few labeled samples. Thus, alleviating the difficulties associated with large dataset collecting and labeling. To demonstrate the efficacy of our approach, we evaluated our model using a self-collected dataset of the recently established QUIC protocol as well as publicly available ISCX VPN-NonVPN dataset. Our approach is able to achieve 89% and 78% accuracy with a very small number of labeled samples (just 10% of the dataset) on both QUIC and ISCX VPN-NonVPN datasets respectively.

ACoPE: An adaptive semi-supervised learning approach for complex-policy enforcement in high-bandwidth networks

Today’s high-bandwidth networks require adaptive analyzing approaches to recognize the network variable behaviors. The analyzing approaches should be robust against the lack of prior knowledge and provide data to impose more complex policies. In this paper, ACoPE is proposed as an adaptive semi-supervised learning approach for complex-policy enforcement in high-bandwidth networks. ACoPE detects and maintains inter-flows relationships to impose complex-policies. It employs a statistical process control technique to monitor accuracy. Whenever the accuracy decreased, ACoPE considers it as a changed behavior and uses data from a deep packet inspection module to adapt itself with the change.The performance of ACoPE in analyzing network traffic is evaluated through UNB ISCX VPN-nonVPN and UNB ISCX Tor-nonTor datasets. The performance is compared with 10 different stream and traditional classification algorithms. ACoPE outperforms the stream classifiers, with 95.92% accuracy, 86.21% precision, and 73.29% recall in VPN dataset, and with 81.12% accuracy, 73.59% precision, and 61.08% recall in Tor dataset. The effectiveness of ACoPE to address the main constraints in analyzing of high-bandwidth networks to enforce security policies, namely comprehensive processing and adaptive learning, are confirmed through three different scenarios. Efficiency and accuracy of ACoPE in real high-bandwidth networks are evaluated by a pilot study, which indicates its efficiency and accuracy in analyzing high-bandwidth networks.

Deep packet: a novel approach for encrypted traffic classification using deep learning

Network traffic classification has become more important with the rapid growth of Internet and online applications. Numerous studies have been done on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a deep learning-based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called “Deep Packet,” can handle both traffic characterization in which the network traffic is categorized into major classes (e.g., FTP and P2P) and application identification in which identifying end-user applications (e.g., BitTorrent and Skype) is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. The Deep Packet framework employs two deep neural network structures, namely stacked autoencoder (SAE) and convolution neural network (CNN) in order to classify network traffic. Our experiments show that the best result is achieved when Deep Packet uses CNN as its classification model where it achieves recall of 0.98 in application identification task and 0.94 in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.