Network Traffic Classification Research Articles

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

Distributed denial-of-service (DDoS) attacks persistently proliferate, impacting individuals and Internet Service Providers (ISPs). Deep learning (DL) models are paving the way to address these challenges and the dynamic nature of potential threats. Traditional detection systems, relying on signature-based techniques, are susceptible to next-generation malware. Integrating DL approaches in cloud-edge/federated servers enhances the resilience of these systems. In the Internet of Things (IoT) and autonomous networks, DL, particularly federated learning, has gained prominence for attack detection. Unlike conventional models (centralized and localized DL), federated learning does not require access to users’ private data for attack detection. This approach is gaining much interest in academia and industry due to its deployment on local and global cloud-edge models. Recent advancements in DL enable training a quality cloud-edge model across various users (collaborators) without exchanging personal information. Federated learning, emphasizing privacy preservation at the cloud-edge terminal, holds significant potential for facilitating privacy-aware learning among collaborators. This paper addresses: (1) The deployment of an optimized deep neural network for network traffic classification. (2) The coordination of federated server model parameters with training across devices in IoT domains. A federated flowchart is proposed for training and aggregating local model updates. (3) The generation of a global model at the cloud-edge terminal after multiple rounds between domains and servers. (4) Experimental validation on the BoT-IoT dataset demonstrates that the federated learning model can reliably detect attacks with efficient classification, privacy, and confidentiality. Additionally, it requires minimal memory space for storing training data, resulting in minimal network delay. Consequently, the proposed framework outperforms both centralized and localized DL models, achieving superior performance.

The Attention-Based Autoencoder for Network Traffic Classification with Interpretable Feature Representation

Network traffic classification is crucial for identifying network applications and defending against network threats. Traditional traffic classification approaches struggle to extract structural features and suffer from poor interpretability of feature representations. The high symmetry between network traffic classification and its interpretable feature representation is vital for network traffic analysis. To address these issues, this paper proposes a traffic classification and feature representation model named the attention mechanism autoencoder (AMAE). The AMAE model extracts the global spatial structural features of network traffic through attention mechanisms and employs an autoencoder to extract local structural features and perform dimensionality reduction. This process maps different network traffic features into one-dimensional coordinate systems in the form of spectra, termed FlowSpectrum. The spectra of different network traffic represent different intervals in the coordinate system. This paper tests the interpretability and classification performance of network traffic features of the AMAE model using the ISCX-VPN2016 dataset. Experimental results demonstrate that by analyzing the overall distribution of attention weights and local weight values of network traffic, the model effectively explains the differences in the spectral representation intervals of different types of network traffic. Furthermore, our approach achieves the highest classification accuracy of up to 100% for non-VPN-encrypted traffic and 99.69% for VPN-encrypted traffic, surpassing existing traffic classification schemes.

Encrypted Network Traffic Classification Using Deep and Parallel Network-In-Network Models

Network traffic classification analyzes received data packets to identify distinct application or traffic kinds. This research describes a neural network model that uses deep and parallel network-in-network (NIN) architectures to classify encrypted network data. In comparison to typical convolutional neural networks (CNN), NIN uses a micro network after each convolution layer to improve local modeling. Furthermore, NIN uses global average pooling instead of traditional fully connected layers before final classification, resulting in a considerable reduction in the number of model parameters. Our suggested solution uses deep NIN models with several MLP convolutional layers to map fixed-length packet vectors to application or traffic labels. Furthermore, a parallel decision method is created to build two sub-networks to process packet headers and packet bodies separately, taking into account that they may include different types of evidence for classification. Our investigations on the ''ISCX VPN-nonVPN'' encrypted traffic dataset demonstrate that NIN models can achieve a better balance between classification accuracy and model complexity than standard CNNs. The parallel decision technique can increase the accuracy of a single NIN model for classifying encrypted network data. Finally, the test set F1 scores of 0.983 and 0.985 are obtained for traffic characterisation and application identification, respectively

Distributionally Robust Federated Learning for Network Traffic Classification With Noisy Labels

Distributionally Robust Federated Learning for Network Traffic Classification With Noisy Labels

Fast and Accurate Multi-Task Learning for Encrypted Network Traffic Classification

The classification of encrypted traffic plays a crucial role in network management and security. As encrypted network traffic becomes increasingly complicated and challenging to analyze, there is a growing need for more efficient and comprehensive analytical approaches. Our proposed method introduces a novel approach to network traffic classification, utilizing multi-task learning to simultaneously train multiple tasks within a single model. To validate the proposed method, we conducted experiments using the ISCX 2016 VPN/Non-VPN dataset, consisting of three tasks. The proposed method outperformed the majority of existing methods in classification with 99.29%, 97.38%, and 96.89% accuracy in three tasks (i.e., encapsulation, category, and application classification, respectively). The efficiency of the proposed method also demonstrated outstanding performance when compared to methods excluding lightweight models. The proposed approach demonstrates accurate and efficient multi-task classification on encrypted traffic.

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

AbstractOver the past decade, there has been a growing surge of interest in leveraging artificial intelligence and machine learning models to address real‐world challenges within the field of telecommunications and networking. Among these challenges, network traffic classification has consistently remained a key focal point within the community. The emergence of new paradigms such as internet of things has added complexity to this challenge, owing to the diverse array of traffic classes it introduces. This complexity is further compounded when dealing with encrypted traffic data. In the context of this paper, we employ explainable artificial intelligence (XAI) techniques to offer insightful explanations for the task of classifying encrypted network traffic. Our approach involves presenting a ranked list of the model's input features, organized based on their significance in influencing the classifier's predictions. These ranked lists shed light on the underlying functionality of the encrypted traffic classification model, enabling users to discern which features hold greater importance in shaping the model's output by harnessing the insights provided by XAI approaches. Moreover, we carry out a quantitative assessment and comparison of the results generated by these XAI methods and outputs of three other conventional, widely adopted feature selection approaches, utilizing them as feature selection techniques when applied to a convolutional neural network for classifying data from the CIC‐Darknet2020 and CIC‐IDS2017 datasets. The results show that XAI techniques have high performance in feature selection for network traffic classification.

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

The demand for encrypted communication is increasing with the continuous development of secure and trustworthy networks. In edge computing scenarios, the requirement for data processing security is becoming increasingly high. Therefore, the accurate identification of encrypted traffic has become a prerequisite to ensure edge intelligent device security. Currently, encrypted network traffic classification relies on single-feature extraction methods. These methods have simple feature extraction, making distinguishing encrypted network data flows and designing compelling manual features challenging. This leads to low accuracy in multi-classification tasks involving encrypted network traffic. This paper proposes a hybrid deep learning model for multi-classification tasks to address this issue based on the synergy of dilated convolution and gating unit mechanisms. The model comprises a Gated Dilated Convolution (GDC) module and a CA-LSTM module. The GDC module completes the spatial feature extraction of encrypted network traffic through dilated convolution and gating unit mechanisms. In contrast, the CA-LSTM module focuses on extracting temporal network traffic features. By employing a collaborative approach to extract spatio-temporal features, the model ensures feature extraction diversity, guarantees robustness, and effectively enhances the feature extraction rate. We evaluate our multi-classification model using the ISCX VPN-nonVPN public dataset. Experimental results show that the proposed method achieves an accuracy rate of over 95% and a recall rate of over 90%, significantly outperforming existing methods.

An improved focal loss for imbalanced network traffic classification

With the continued progress of the Internet, network security has become an increasingly significant issue that requires constant attention and research. Network traffic classification is a key technology used to detect and prevent malicious network activity, and it has accordingly received increasing attention and research. However, datasets related to malicious network traffic classification often have imbalanced characteristics. In conventional traffic classification problems with multiple categories, the sample size characteristics of small categories are often overlooked. To address this issue, the focal loss function was proposed, which focuses on small samples by modulating the trade-off between the positive and negative samples through two hyperparameters and . This article uses convolutional neural networks (CNN) to tackle traffic classification problem and explore the optimal values of parameters in this application scenario. Additionally, this work proposed a novel weight allocation formula to replace , which allowed small class traffic to obtain higher accuracy.

A lightweight Intrusion Detection for Internet of Things‐based smart buildings

AbstractThe integration of Internet of Things (IoT) devices into commercial or industrial buildings to create smart environments, such as Smart Buildings (SBs), has enabled real‐time data collection and processing to effectively manage building operations. Due to poor security design and implementation in IoT devices, SB networks face an array of security challenges and threats (e.g., botnet malware) that leverage IoT devices to conduct Distributed Denial of Service (DDoS) attacks on the Internet infrastructure. Machine Learning (ML)‐based traffic classification systems aim to automatically detect such attacks by effectively differentiating attacks from benign traffic patterns in IoT networks. However, there is an inherent accuracy‐efficiency tradeoff in network traffic classification tasks. To balance this tradeoff, we develop an accurate yet lightweight device‐specific traffic classification model. This model classifies SB traffic flows into four types of coarse‐grained flows, based on the locations of traffic sources and the directions of traffic transmissions. Through these four types of coarse‐grained flows, the model can extract simple yet effective flow rate features to conduct learning and predictions. Our experiments find the model to achieve an overall accuracy of 96%, with only 32 features to be learned by the ML model.

One-dimensional CNN Model of Network Traffic Classification based on Transfer Learning

One-dimensional CNN Model of Network Traffic Classification based on Transfer Learning

CM-UTC: A Cost-sensitive Matrix based Method for Unknown Encrypted Traffic Classification

Abstract Deep learning has been widely adopted in the field of network traffic classification due to its unique advantages in handling encrypted network traffic. However, most existing deep learning models can only classify known encrypted traffic that has been sampled and labeled. In this paper, we propose CM-UTC, a cost-sensitive matrix-based method for classifying unknown encrypted traffic. CM-UTC explores the probability distribution of the DNN output layer to filter out the unknown classes and further designs a cost-sensitive matrix to address the class imbalance problem. Additionally, we propose the utilization of the Harris Hawk optimization algorithm to modify the model parameters and improve its performance. The experiments are validated on two different datasets, and the results demonstrate that CM-UTC not only outperforms existing methods in terms of overall performance but also exhibits superior capability in correctly identifying samples from the minority class.

Network traffic classification based on federated semi-supervised learning

Traffic Classification (TC) has been applied to a wide range of applications, from security monitoring to quality of service (QoS) provisioning in network Internet Service Providers (ISPs). In recent years, many researchers have applied Machine Learning (ML) or Deep Learning (DL) to TC, namely AI-TC. However, AI-TC methods face significant challenges, including high data dependency, exhaustively costly traffic labeling, and network subscribers’ privacy. This paper proposes a TC framework for smart home networks using Federated Learning (FL) that protects traffic data privacy by performing local training and inference of TC models. Firstly, we design a DPI-based traffic labeling method on edge home gateways as FL nodes, which enables these nodes to have data labeling capability while protecting data privacy. Then, a semi-supervised TC model based on an autoencoder (AE) is proposed to reduce the dependence of the model on labeled traffic samples. Finally, an XAI-based method is utilized to interpret the model to ensure its explainability. We validate the proposed method on public and real datasets using benchmarking methods. The experimental results show that the method can achieve high performance using a small number of samples while protecting data privacy and improving the model’s credibility. Experimental code can be found in the following url: https://github.com/PrinceXuan12138/HGW-TC-Experimental-code.

Time‐based DDoS attack detection through hybrid LSTM‐CNN model architectures: An investigation of many‐to‐one and many‐to‐many approaches

SummaryInternet data thefts, intrusions and DDoS attacks are some of the big concerns for the network security today. Detection of these anomalies, is gaining tremendous impetus with the development of machine learning and artificial intelligence. Even now researchers are shifting the base from machine learning to the deep neural architectures with auto‐feature selection capabilities. We in this paper propose multiple deep neural network architectures which can select, co‐learn and teach the gradients of the neural network by itself with no human intervention. This is what we call as meta‐learning. The models are configured in both many to one and many to many design architectures. We combine long short‐term memory (LSTM), bi‐directional long short‐term memory (BiLSTM), convolutional neural network (CNN) layers along with attention mechanism to achieve the higher accuracy values among all the available deep learning model architectures. LSTMs overcomes the vanishing and exploding gradient problem of RNN and attention mechanism mimics the human cognitive attention that screens the network flow to obtain the key features for network traffic classification. In addition, we also add multiple convolutional layers to get the key features for network traffic classification. We get the time series analysis of the traffic done for the possibility of a DDoS attack without using any feature selection techniques and without balancing the dataset. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate (FAR), sensitivity, specificity, false‐positive rate (FPR), F1 score, area under curve (AUC) analysis and loss functions on well‐known public benchmark KDD Cup'99 data set. The results of our experiments reveal that our models outperform existing techniques, showing their superiority in performance.

Traffic Classification and Packet Scheduling Strategy with Deadline Constraints for Input-Queued Switches in Time-Sensitive Networking

Deterministic transmission technology is a core key technology that supports deterministic real-time transmission requirements for industrial control in Time-Sensitive Networking (TSN). It requires each network node to have a deterministic forwarding delay to ensure the real-time end-to-end transmission of critical traffic streams. Therefore, when forwarding data frames, the switch nodes must consider the time-limited requirements of the traffic. In the input-queued switch system, an algorithm for clock-synchronized deterministic network traffic classification scheduling (CSDN-TCS) is proposed to address the issue of whether a higher-quality-of-service (QoS) performance can be provided under packet deadline constraints. First, the scheduling problem of the switch is transformed into a decomposition problem of the traffic matrix. Secondly, the maximum weight-matching algorithm in graph theory is used to solve the matching results slot by slot. By fully utilizing the slot resources, as many packets as possible can be scheduled to be completed before the deadline arrives. For two types of packet scheduling problems, this paper uses the maximum flow algorithm with upper- and lower-bound constraints to move packets from a larger deadline set to idle slots in a smaller deadline set, enabling early transmission, reducing the average packet delay, and increasing system throughput. When there are three or more types of deadlines in the scheduling set, this scheduling problem is an NP-hard problem. We solve this problem by polling the two types of scheduling algorithms. In this paper, simulation experiments based on the switching size and line load are designed, and the Earliest Deadline First (EDF) algorithm and the Flow-Based Iterative Packet Scheduling (FIPS) algorithm are compared with the CSDN-TCS algorithm. The simulation results show that under the same conditions, the CSDN-TCS algorithm proposed in this paper outperforms the other two algorithms in terms of success rate, packet loss rate, average delay and throughput rate. Compared with the FIPS algorithm, the CSDN-TCS algorithm has lower time complexity under the same QoS performance.

Method for multi-task learning fusion network traffic classification to address small sample labels

In the context of the proliferated evolution of network service types and the expeditious augmentation of network resource deployment, the requisition for copious labeled datasets to facilitate superior performance in traffic classification methods, particularly those hinging on deep learning, is imperative. Nonetheless, the procurement and annotation of such extensive datasets necessitate considerable temporal and human resource investments. In response to this predicament, this work introduces a methodology, termed MTEFU, leveraging a deep learning model-based multi-task learning algorithm, strategically designed to mitigate the reliance on substantial labeled training samples. Multiple classification tasks, encompassing duration, bandwidth size, and business traffic category, are incorporated, with a shared parameter strategy implemented amongst tasks to assure the transference of information across disparate tasks. Employing CNN, SAE, GRU, and LSTM as multi-task learning classification models, training validation and experimental testing were conducted on the QUIC dataset. A comparative analysis with single-task and ensemble learning methods reveals that, in the context of predicting network traffic types, the accuracy derived from the multi-task learning strategy, even with a mere 150 labeled samples, can emulate the 94.67% accuracy achieved through single-task learning with a fully labeled dataset of 6139 samples.

OptiClass : An Optimized Classifier for Application Layer Protocols Using Bit Level Signatures

Network traffic classification has many applications, such as security monitoring, quality of service, traffic engineering, and so on. For the aforementioned applications, Deep Packet Inspection (DPI) is a popularly used technique for traffic classification because it scrutinizes the payload and provides comprehensive information for accurate analysis of network traffic. However, DPI-based methods reduce network performance because they are computationally expensive and hinder end-user privacy as they analyze the payload. To overcome these challenges, bit-level signatures are significantly used to perform network traffic classification. However, most of these methods still need to improve performance as they perform one-by-one signature matching of unknown payloads with application signatures for classification. Moreover, these methods become stagnant with the increase in application signatures. Therefore, to fill this gap, we propose OptiClass , an optimized classifier for application protocols using bit-level signatures. OptiClass performs parallel application signature matching with unknown flows, which results in faster, more accurate, and more efficient network traffic classification. OptiClass achieves twofold performance gains compared to the state-of-the-art methods. First, OptiClass generates bit-level signatures of just 32 bits for all the applications. This keeps OptiClass swift and privacy-preserving. Second, OptiClass uses a novel data structure called BiTSPLITTER for signature matching for fast and accurate classification. We evaluated the performance of OptiClass on three datasets consisting of twenty application protocols. Experimental results report that OptiClass has an average recall, precision, and F1-score of 97.36%, 97.38%, and 97.37%, respectively, and an average classification speed of 9.08 times faster than five closely related state-of-the-art methods.

NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification

Network traffic monitoring based on IP Flows is a standard monitoring approach that can be deployed to various network infrastructures, even the large ISP networks connecting millions of people. Since flow records traditionally contain only limited information (addresses, transport ports, and amount of exchanged data), they are also commonly extended by additional features that enable network traffic analysis with high accuracy. These flow extensions are, however, often too large or hard to compute, which then allows only offline analysis or limits their deployment only to smaller-sized networks. This paper proposes a novel extended IP flow called NetTiSA (Network Time Series Analysed) flow, based on analysing the time series of packet sizes. By thoroughly testing 25 different network traffic classification tasks, we show the broad applicability and high usability of NetTiSA flow. For practical deployment, we also consider the sizes of flows extended by NetTiSA features and evaluate the performance impacts of their computation in the flow exporter. The novel features proved to be computationally inexpensive and showed excellent discriminatory performance. The trained machine learning classifiers with proposed features mostly outperformed the state-of-the-art methods. NetTiSA finally bridges the gap and brings universal, small-sized, and computationally inexpensive features for traffic classification that can be scaled up to extensive monitoring infrastructures, bringing the machine learning traffic classification even to 100Gbps backbone lines.

Implement an Intrusion Detection System Utilizing Machine Learning and Principal Component Analysis

The ever-evolving cybersecurity sector requires robust intrusion detection systems (IDS). Traditional rules-based measures are no longer sufficient due to the complexity of cyber threats, requiring new approaches. This study presents the architecture of an intrusion detection system combining machine learning and principal component analysis (PCA) to increase network security. A network traffic classification system was built and tested on the NSL-KDD dataset and used PCA for dimensionality reduction. The results were cross-validated to reduce overfitting and ensure generalizability of the model. Low-variance precision refers to the consistency of the cross-validation fold. The combination of PCA and machine learning models exceeds previous studies with an F1 score for the random forest model of over 99%. The study improves intrusion detection and network protection against cyber-attacks.

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

Machine learning (ML) models are essential to securing communication networks. However, these models are vulnerable to adversarial examples (AEs), in which malicious inputs are modified by adversaries to produce the desired output. Adversarial training is an effective defense method against such attacks but relies on access to a substantial number of AEs, a prerequisite that entails significant computational resources and the inherent limitation of poor performance on clean data. To address these problems, this study proposes a novel approach to improve the robustness of ML-based network traffic classification models by integrating derived variables (DVars) into training. Unlike adversarial training, our approach focuses on enhancing training using DVars, introducing randomness into the input data. DVars are generated from the baseline dataset and significantly improve the resilience of the model to AEs. To evaluate the effectiveness of DVars, experiments were conducted using the CSE-CIC-IDS2018 dataset and three state-of-the-art ML-based models: decision tree (DT), random forest (RF), and k-neighbors (KNN). The results show that DVars can improve the accuracy of KNN under attack from 0.45% to 0.84% for low-intensity attacks and from 0.32% to 0.66% for high-intensity attacks. Furthermore, both DT and RF achieve a significant increase in accuracy when subjected to attack of different intensity. Moreover, DVars are computationally efficient, scalable, and do not require access to AEs.

Machine learning based fileless malware traffic classification using image visualization

In today’s interconnected world, network traffic is replete with adversarial attacks. As technology evolves, these attacks are also becoming increasingly sophisticated, making them even harder to detect. Fortunately, artificial intelligence (AI) and, specifically machine learning (ML), have shown great success in fast and accurate detection, classification, and even analysis of such threats. Accordingly, there is a growing body of literature addressing how subfields of AI/ML (e.g., natural language processing (NLP)) are getting leveraged to accurately detect evasive malicious patterns in network traffic. In this paper, we delve into the current advancements in ML-based network traffic classification using image visualization. Through a rigorous experimental methodology, we first explore the process of network traffic to image conversion. Subsequently, we investigate how machine learning techniques can effectively leverage image visualization to accurately classify evasive malicious traces within network traffic. Through the utilization of production-level tools and utilities in realistic experiments, our proposed solution achieves an impressive accuracy rate of 99.48% in detecting fileless malware, which is widely regarded as one of the most elusive classes of malicious software.