Network Traffic Classification Research Articles

A Review of Deep Learning Techniques for Encrypted Traffic Classification

Network traffic classification is significant for task such as Quality of Services (QoS) provisioning, resource usage planning, pricing as well as in the context of security such as in Intrusion detection systems. The field has received considerable attention in the industry as well as research communities where approaches such as Port based, Deep packet Inspection (DPI), and Classical machine learning techniques were thoroughly studied. However, the emergence of new applications and encryption protocols as a result of continuous transformation of Internet has led to the rise of new challenges. Recently, researchers have employed deep learning techniques in the domain of network traffic classification in order to leverage the inherent advantages offered by deep learning models such as the ability to capture complex pattern as well as automatic feature learning. This paper reviews deep learning based encrypted traffic classification techniques, as well as highlights the current research gap in the literature. Index Terms : Traffic classification, Encrypted traffic, Deep learning, Machine learning.

Robust network traffic identification with graph matching

Network traffic identification is of great value as an effective way for network management. Typically, intelligent classifiers are deployed for advanced network protection, including intrusion traffic detection and network behavior monitoring etc. Robust network traffic classifiers with generalization ability should also ensure stable performance in various network environments. Unfortunately, although the existing network traffic classifiers can achieve the claimed performance when initialized and tested in invariant network environments with stable attribute distributions, they are inclined to fail when adapting to varying practical networks and suffer from significant performance degradation. Based on analysis of representative state-of-the-art classifiers with respect to their transferability, we arrive at that feature distribution of the same class is vulnerable to the changes of networking which account for the degradation of most existing methods. To tackle the issues, we propose a weakly-supervised network traffic classification method based on graph matching. Specifically, network sessions are aggregated to several clusters with the extracted principal features through weakly-supervised clustering. Moreover, we measure the correlations between clusters from the same networks to construct the similarity graphs. Clusters from the testing network are associated with those from the initial network by the carefully designed graph matching algorithm, so that the testing clusters can be labeled according to the associated ones in the initialized network. Our method shows eye-catching robustness, achieving an accuracy of 88.19% when practically deployed in different networks, which significantly outperforms the existing approaches.

EBSNN: Extended Byte Segment Neural Network for Network Traffic Classification

Network traffic classification is important to intrusion detection and network management. Most of existing methods are based on machine learning techniques and rely on the features extracted manually from flows or packets. However, with the rapid growth of network applications, it is difficult for these approaches to handle new complex applications. In this article, we design a novel neural network, the Extended Byte Segment Neural Network (EBSNN), to classify netwrk traffic. EBSNN first divides a packet into header segments and payload segments, which are then fed into encoders composed of the recurrent neural networks with the attention mechanism. Based on the outputs, another encoder learns the high-level representation of the whole packet. In particular, side-channel features are learned from header segments to improve the performance. Finally, the label of the packet is obtained by the softmax function. Furthermore, EBSNN can classify network flows by examining the first few packets. Thorough experiments on the real-world datasets show that EBSNN achieves better performance than the state-of-the-art methods in both the application identification task and the website identification task.

MANTA: Multi-Lane Capsule Network Assisted Traffic Classification for 5G Network Slicing

As network slicing is an enabling technology for the fifth-generation (5G) networks, it comes with complex challenges to ensure that resource management is consistent with slice tenant activities to provide better performance and cost-effective services to different tenants tailored to their needs. To this end, traffic classification is fundamental for the provisioning of the resources in a network by analyzing the network traffic to anticipate future requests. However, the massive increase of heterogeneous traffic features challenges dynamic network slices traffic classification. Previous literature have explored statistical and machine learning techniques but are constrained by feature engineering and computational costs. In this letter, we propose the multi-lane CapsNet assisted network traffic classification (MANTA), a framework based on multi-lane Capsule Networks (CapsNet) deep learning technique, to identify and classify heterogeneous traffic flows in 5G network slicing. Furthermore, we conduct a comparative analysis of the model with previous literature using deep learning techniques. The experimental results exhibit improved performance with high accuracy of 97.3975%, compared with other classifiers from previous literature.

Network Traffic Obfuscation against Traffic Classification

In recent years, tremendous progress has been made in network traffic classification and its use has become ubiquitous in many emerging applications, such as Internet censorship in many countries and ISP traffic engineering. However, the traffic analysis of intermediaries brings the risk of privacy disclosure to users. This paper presents a network traffic obfuscation technology to resist traffic classification. It deceives the machine learning and deep learning models by generating adversarial samples. The adversarial samples generation algorithm includes a white-box attack algorithm based on fuzzy strategy and a black-box attack algorithm based on smote data enhancement. Experiments based on the ISCXTor2016 public data set show that the MIM algorithm has the best performance in white-box attacks, and the obfuscation success rate of DNN and LSTM models is 90%. In the black-box attack, the obfuscation effect of LSTM is the best, while CNN has stronger robustness.

The use of generative adversarial networks to alleviate class imbalance in tabular data: a survey

The existence of class imbalance in a dataset can greatly bias the classifier towards majority classification. This discrepancy can pose a serious problem for deep learning models, which require copious and diverse amounts of data to learn patterns and output classifications. Traditionally, data-level and algorithm-level techniques have been instrumental in mitigating the adverse effect of class imbalance. With the recent development and proliferation of Generative Adversarial Networks (GANs), researchers across a variety of disciplines have adapted the architecture of GANs and implemented them on imbalanced datasets to generate instances of the underrepresented class(es). Though the bulk of research has been centered on the application of this methodology in computer vision tasks, GANs are likewise being appropriated for use in tabular data, or data consisting of rows and columns with traditional structured data types. In this survey paper, we assess the methodology and efficacy of these modifications on tabular datasets, across domains such network traffic classification and financial transactions over the past seven years. We examine what methodologies and experimental factors have resulted in the greatest machine learning efficacy, as well as the research works and frameworks which have proven most influential in the development of the application of GANs in tabular data settings. Specifically, we note the prevalence of the CGAN architecture, the optimality of novel methods with CNN learners and minority-class sensitive measures such as F1 score, the popularity of SMOTE as a baseline technique, and the improved performance in the year-over-year use of GANs in imbalanced tabular datasets.

Multi-Agent-Based Traffic Prediction and Traffic Classification for Autonomic Network Management Systems for Future Networks

Recently, a multi-agent based network automation architecture has been proposed. The architecture is named multi-agent based network automation of the network management system (MANA-NMS). The architectural framework introduced atomized network functions (ANFs). ANFs should be autonomous, atomic, and intelligent agents. Such agents should be implemented as an independent decision element, using machine/deep learning (ML/DL) as an internal cognitive and reasoning part. Using these atomic and intelligent agents as a building block, a MANA-NMS can be composed using the appropriate functions. As a continuation toward implementation of the architecture MANA-NMS, this paper presents a network traffic prediction agent (NTPA) and a network traffic classification agent (NTCA) for a network traffic management system. First, an NTPA is designed and implemented using DL algorithms, i.e., long short-term memory (LSTM), gated recurrent unit (GRU), multilayer perceptrons (MLPs), and convolutional neural network (CNN) algorithms as a reasoning and cognitive part of the agent. Similarly, an NTCA is designed using decision tree (DT), K-nearest neighbors (K-NN), support vector machine (SVM), and naive Bayes (NB) as a cognitive component in the agent design. We then measure the NTPA prediction accuracy, training latency, prediction latency, and computational resource consumption. The results indicate that the LSTM-based NTPA outperforms compared to GRU, MLP, and CNN-based NTPA in terms of prediction accuracy, and prediction latency. We also evaluate the accuracy of the classifier, training latency, classification latency, and computational resource consumption of NTCA using the ML models. The performance evaluation shows that the DT-based NTCA performs the best.

GRANULAR NETWORK TRAFFIC CLASSIFICATION FOR STREAMING TRAFFIC USING INCREMENTAL LEARNING AND CLASSIFIER CHAIN

In modern networks, network visibility is of utmost importance to network operators. Accordingly, granular network traffic classification quickly rises as an essential technology due to its ability to provide high network visibility. Granular network traffic classification categorizes traffic into detailed classes like application names and services. Application names represent parent applications, such as Facebook, while application services are the individual actions within the parent application, such as Facebook-comment. Most studies on granular classification focus on classification at the application name level. Besides that, evaluations in existing studies are also limited and utilize only static and immutable datasets, which are insufficient to reflect the continuous and evolving nature of real-world traffic. Therefore, this paper aims to introduce a granular classification technique, which is evaluated on streaming traffic. The proposed technique implements two Adaptive Random Forest classifiers linked together using a classifier chain to simultaneously produce classification at two granularity levels. Performance evaluation on a streaming testbed setup using Apache Kafka showed that the proposed technique achieved an average F1 score of 99% at the application name level and 88% at the application service level. Additionally, the performance benchmark on ISCX VPN non-VPN public dataset also maintained comparable results, besides recording classification time as low as 2.6 ms per packet. The results conclude that the proposed technique proves its advantage and feasibility for a granular classification in streaming traffic.

Packet Analysis for Network Forensics

If the packet characteristics acquired are sufficiently detailed, packet analysis is a common forensic approach in network forensics that can replay the whole network traffic for a specified time period. This can be used to find evidence of illicit online activity such as data breaches, unauthorized website access, malware infection, and infiltration attempts, as well as to reproduce image files, documents, email attachments, and other material sent over the network. This paper covers a comprehensive assessment of the usage of packet analysis, including deep packet inspection, in network forensics, as well as a discussion of AI-powered packet analysis methodologies with sophisticated network traffic classification and pattern recognition. Keywords: Cybersecurity; Network Security; Traffic Analysis; Deep Inspection; Intrusion Detection; Network Forensics

Knowledge-defined networking: Applications, challenges and future work

Future 6G wireless communication systems are expected to feature intelligence and automation. Knowledge-defined networking (KDN) is an evolutionary step toward autonomous and self-driving networks. The building blocks of the KDN paradigm in achieving self-driving networks are software-defined networking (SDN), packet-level network telemetry, and machine learning (ML). The KDN paradigm intends to integrate intelligence to manage and control networks automatically. In this study, we first introduce the disadvantages of current network technologies. Then, the KDN and associated technologies are explored with three possible KDN architectures for heterogeneous wireless networks. Furthermore, a thorough investigation of recent survey studies on different wireless network applications was conducted. The aim is to identify and review suitable ML-based studies for KDN-based wireless cellular networks. These applications are categorized as resource management, network management, mobility management, and localization. Resource management applications can be further classified as spectrum allocation, power management, quality-of-service (QoS), base station (BS) switching, cache, and backhaul management. Within network management configurations, routing strategies, clustering, user/BS association, traffic classification, and data aggregation were investigated. Applications in mobility management include user mobility prediction and handover management. To improve the accuracy of positioning in indoor environments, localization techniques were discussed. We classify existing research into the respective KDN architecture and identify how the knowledge obtained will enhance future networks; as a result, researchers can extend their work to empower intelligence and self-organization in the network using the KDN paradigm. Finally, the requirements, motivations, applications, challenges, and open issues are presented.

End-to-End Machine Learning Pipeline for Real-Time Network Traffic Classification and Monitoring in Android Automotive

The aim of this work is to build a network traffic monitoring application that is capable of categorizing network data traffic based on their application usage into 7 types: Browsing, Chat, Email, File Transfer, Streaming, VoIP and P2P. Flow-wise data is analyzed after the traffic stream is fed into the CICFlowmeter. Live traffic flow is fed to various ML models and algorithms such as K-Means Clustering algorithm, Agglomerative Clustering, Mean-shift algorithm, Random Forest Classifier, Adaptive Boosting algorithm, Gradient Boosting algorithm, Linear Discriminant analysis, Naive Bayes classifier, Classification and regression trees and the Support Vector Machine model. K-fold cross validation test is conducted, which derived results depicting the best of the models to be the Random Forest Classifier. We used 23 features for model training based on their importances. Model evaluation is done using the confusion matrix. Class imbalances are handled effectively with a comparative study of both under-sampling and oversampling of the dataset. Oversampling using SMOTE produces better results. The important timebased features in classification is recorded for further studies. The model used was fast enough to classify the flows in real time and display the analytics in the dashboard. The Flask framework is used to build a live dashboard to display the network traffic classified along with the several important features. We were able to prove that network traffic classification cam be done using time-based features which does not violate data protection laws. Network traffic classification using Random forest algorithm on oversampled dataset gave an overall accuracy of 0.92 was achieved.

Performance Comparison of Ensemble Learning and Supervised Algorithms in Classifying Multi-label Network Traffic Flow

Network traffic classification is of significant importance. It helps identify network anomalies and assists in taking measures to avoid them. However, classifying network traffic correctly is a challenging task. This study aims to compare ensemble learning methods with normal supervised classification to come up with improved classification methods. Three types of network traffic were classified (Benign, Malicious, and Outliers). The data were collected experimentally by using Paessler Router Traffic Grapher software and online and were analyzed by R software. The datasets were used to train five supervised models (k-nearest neighbors, mixture discriminant analysis, Naïve Bayes, C5.0 classification model, and regularized discriminant analysis). The models were trained by 70% of the samples and the rest 30% were used for validation. The same samples were used separately in predicting individual accuracy. The results were compared to the ensemble learning models which were built with the use of the same datasets. Among the five supervised classifiers, k-nearest neighbors and C5.0 classification scored the highest accuracy of 0.868 and 0.761. The ensemble learning classifiers Bagging (Random Forest) and Boosting (eXtreme Gradient Boosting) had accuracy of 0.904 and 0.902 respectively. The results show that the ensemble learning method has higher accuracy compared to the normal supervised classifiers. Therefore, it can be used to detect malicious activities in network traffic as well as anomalies with improved accuracy.

A Multi-Scale Feature Attention Approach to Network Traffic Classification and Its Model Explanation

Network traffic classification, the task of associating network traffic with their generating application protocols or applications, is valuable for the control, allocation, and management of resources in today’s TCP/IP networks. In this paper, we propose Ulfar, a multi-scale feature attention approach to network traffic classification, which uses convolutional neural networks (CNN) as the building block of the deep packet analysis model. In Ulfar, we take only one packet per flow for network traffic classification. Ulfar is based on the key insight that format-related bytes appear at fixed offsets or in a specific pattern in the IP packet, and these format-related bytes are important for accurate network traffic classification. Our neural network model can automatically recover the format-related bytes by building high-level, multi-scale <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${n}$ </tex-math></inline-formula> -gram features from raw byte sequences. In addition, at the representation learning side, we try to understand what patterns and signatures our neural network model learns from network traffic. We evaluate Ulfar using two publicly available datasets, and our experimental results show that Ulfar can conduct accurate network traffic classification. Also, we compare the results of Ulfar with four state-of-the-art approaches, and find that Ulfar has the ability to classify network traffic more accurately.

Network Traffic Classification Based On A Deep Learning Approach Using NetFlow Data

Abstract Network traffic classification is of fundamental importance to a wide range of network activities, such as security monitoring, accounting, quality of service and forecasting for long-term provisioning purposes. This task has been increasingly implemented using machine learning methods due to the inability of conventional approaches to accommodate the increasing use of encryption. However, the application of machine learning methods to network traffic classification based on sampled NetFlow data is poorly developed despite the fact that NetFlow is a widely extended monitoring solution routinely employed by network operators. This study addresses this issue by proposing a network traffic classification module using NetFlow data in conjunction with a deep neural network. The performance of the proposed classification module is demonstrated by its application to two real-world datasets, and an average classification accuracy of 95% is obtained for $\sim $1.4 million test cases. Moreover, the performance of the proposed classifier is demonstrated to be superior to three other state-of-the-art classifiers. Accordingly, the proposed module represents a promising alternative for network traffic classification.

Network traffic classification using convolutional neural network and ant-lion optimization

Traffic identification has become a challenging task in recent years. Recently, deep learning methods have been extensively studied for network traffic classification recently. Unfortunately, these models require a large amount of training data. Another challenge with most traffic classification methods is that the features must be extracted by an expert. In these methods, finding the desired features that lead to a better classification is very tedious and time-consuming. In this regard, an excellent solution to address this challenge is to use of deep learning methods that automatically extract features. This paper is an attempt to address these issues by using a combination of the convolutional neural network (CNN), the ant-lion meta-heuristic algorithm (ALO), and the self-organizing map (SOM) to create a traffic classification model that can accurately identify traffic types. The proposed method was able to identify encrypted traffic and distinguish between VPN and non-VPN traffics. The model was evaluated using the “ISCX VPN-non-VPN” dataset, and achieved 98% accuracy.

Traffic Classification in Underwater Networks Using SDN and Data-Driven Hybrid Metaheuristics

Software-Defined Networks ( SDNs ), with their segregated data and control planes, has proved to be capable of managing massive amounts of data by leveraging distributed information available across the network for informed decision-making at the network controller. However, with the proliferation of next-generation, real-time Internet of Things ( IoT ) applications that vary greatly in terms of data frequency and volumes, data traffic classification can substantially assist SDN controllers toward efficient routing and traffic engineering decisions. Existing works on network classification are limited by their application-centric nature, thus overlooking the key criterion for real-time IoT applications, namely, Quality of Service ( QoS ). In this article, we focus on augmenting SDN controllers’ decision-making capacity and Underwater Sensor Networks with machine learning algorithms to achieve real-time, QoS-aware, network traffic classification. Three classifiers, namely, Feed-forward Neural Network, Naïve Bayes, and Logistics Regression have been employed with a novel Artificial Neural Network and Particle Swarm Optimization hybridization scheme by carrying first- and second-order stability analysis for performance improvement of these classifiers. In short, the proposed framework exploits optimization algorithms and semi-supervised machine learning ( ML ) for precise traffic classification while keeping communication overhead between controller and switches minimal. Results obtained from real-life datasets demonstrate the efficacy of our proposed scheme.

TiSEFE: Time Series Evolving Fuzzy Engine for Network Traffic Classification

Monitoring and analyzing network traffic are very crucial in discriminating the malicious attack. As the network traffic is becoming big, heterogeneous, and very fast, traffic analysis could be considered as big data analytic task. Recent research in big data analytic filed has produces several novel large-scale data processing systems. However, there is a need for a comprehensive data processing system to extract valuable insights from network traffic big data and learn the normal and attack network situations. This paper proposes a novel evolving fuzzy system to discriminate anomalies by inspecting the network traffic. After capturing traffic data, the system analyzes it to establish a model of normal network situation. The normal situation is a time series data of an ordered sequence of traffic information variable values at equally spaced time intervals. The performance has been analyzed by carrying out several experiments on real-world traffic dataset and under extreme difficult situation of high-speed networks. The results have proved the appropriateness of time series evolving fuzzy engine for network classification.

ABL-TC: A lightweight design for network traffic classification empowered by deep learning

Network traffic classification is an increasingly significant prerequisite for network management. An accurate traffic classifier can contribute to traffic engineering, traffic intrusion detection and user behavior analysis. Recently, deep learning (DL) has attracted considerable attention for traffic classification due to its excellent learning ability without the need for handcrafted feature engineering or privacy invasion. However, most DL-based traffic classification solutions mainly focus on improving the identification performance, with no regard for the computational and memory burden caused by a large model size or data redundancy. Motivated by the above gaps, we elaborate on the preprocessing of raw traffic data and investigate a lightweight traffic classifier. Specifically, we design a preprocessing approach to convert raw traffic data into available datasets for deep learning based traffic classifiers, which tailors raw traffic data as training datasets by resolving its structure and content and pruning redundant information. Thanks to its ability to focus on key information, attention mechanism is introduced to design an attention-based long short-term memory (LSTM) model for traffic classification, termed the ABL-TC. ABL-TC can effectively identify global dependencies between the input and the output with a limited number of important raw features, which can contribute to learning key information to identify various traffic types. Extensive experiments on real-world public datasets show that the ABL-TC outperforms state-of-the-art approaches in terms of various metrics for recognizing traffic categories while remaining competitive in terms of time and memory efficiency.

Active Learning for Network Traffic Classification: A Technical Study

Network Traffic Classification (NTC) has become an important feature in various network management operations, e.g., Quality of Service (QoS) provisioning and security services. Machine Learning (ML) algorithms as a popular approach for NTC can promise reasonable accuracy in classification and deal with encrypted traffic. However, ML-based NTC techniques suffer from the shortage of labeled traffic data which is the case in many real-world applications. This study investigates the applicability of an active form of ML, called Active Learning (AL), in NTC. AL reduces the need for a large number of labeled examples by actively choosing the instances that should be labeled. The study first provides an overview of NTC and its fundamental challenges along with surveying the literature on ML-based NTC methods. Then, it introduces the concepts of AL, discusses it in the context of NTC, and review the literature in this field. Further, challenges and open issues in AL-based classification of network traffic are discussed. Moreover, as a technical survey, some experiments are conducted to show the broad applicability of AL in NTC. The simulation results show that AL can achieve high accuracy with a small amount of data.

A Cost-Sensitive Deep Learning-Based Approach for Network Traffic Classification

Network traffic classification (NTC) plays an important role in cyber security and network performance, for example in intrusion detection and facilitating a higher quality of service. However, due to the unbalanced nature of traffic datasets, NTC can be extremely challenging and poor management can degrade classification performance. While existing NTC methods seek to re-balance data distribution through resampling strategies, such approaches are known to suffer from information loss, overfitting, and increased model complexity. To address these challenges, we propose a new cost-sensitive deep learning approach to increase the robustness of deep learning classifiers against the imbalanced class problem in NTC. First, the dataset is divided into different partitions, and a cost matrix is created for each partition by considering the data distribution. Then, the costs are applied to the cost function layer to penalize classification errors. In our approach, costs are diverse in each type of misclassification because the cost matrix is specifically generated for each partition. To determine its utility, we implement the proposed cost-sensitive learning method in two deep learning classifiers, namely: stacked autoencoder and convolution neural networks. Our experiments on the ISCX VPN-nonVPN dataset show that the proposed approach can obtain higher classification performance on low-frequency classes, in comparison to three other NTC methods.