Traffic Classification Model Research Articles

DA-Transfer: A Transfer Method for Malicious Network Traffic Classification with Small Sample Problem

Deep learning is successful in providing adequate classification results in the field of traffic classification due to its ability to characterize features. However, malicious traffic captures insufficient data and identity tags, which makes it difficult to reach the data volume required to drive deep learning. The problem of classifying small-sample malicious traffic has gradually become a research hotspot. This paper proposes a small-sample malicious traffic classification method based on deep transfer learning. The proposed DA-Transfer method significantly improves the accuracy and efficiency of the small-sample malicious traffic classification model by integrating both data and model transfer adaptive modules. The data adaptation module promotes the consistency of the distribution between the source and target datasets, which improves the classification performance by adaptive training of the prior model. In addition, the model transfer adaptive module recommends the transfer network structure parameters, which effectively improves the network training efficiency. Experiments show that the average classification accuracy of the DA-Transfer method reaches 93.01% on a small-sample dataset with less than 200 packets per class. The training efficiency of the DA-Transfer model is improved by 20.02% compared to traditional transfer methods.

Lightweight Traffic Classification Model Based on Deep Learning

The development of mobile computing and the Internet of Things (IoT) has led to a surge in traffic volume, which creates a heavy burden for efficient network management. The network management requires high computational overheads to make traffic classification, which is even worse when in edge networks; existing approaches sacrifice the efficiency to obtain high-precision classification results, which are no longer suitable for limited resources edge network scenario. Given the problem, existing traffic classification generally has huge parameters and especially computational complexity. We propose a lightweight traffic classification model based on the Mobilenetv3 and improve it for an ingenious balance between performance and lightweight. Firstly, we adjust the model scale, width, and resolution to substantially reduce the number of model parameters and computations. Secondly, we embed precise spatial information on the attention mechanism to enhance the traffic flow-level feature extraction capability. Thirdly, we use the lightweight multiscale feature fusion to obtain the multiscale flow-level features of traffic. Experiments show that our model has excellent classification accuracy and operational efficiency. The accuracy of the traffic classification model designed in our work has reached more than 99.82%, and the parameter and computation amount are significantly reduced to 0.26 M and 5.26 M. In addition, the simulation experiments on Raspberry Pi prove the proposed model can realize real-time classification capability in the edge network.

A New Imbalanced Encrypted Traffic Classification Model Based on CBAM and Re-Weighted Loss Function

The accurate classification of traffic data is challenging for network management and security, especially in imbalanced situations. The limitation of the existing convolutional neural networks is that they have problems such as overfitting, instability, and poor generalization when used to classify imbalanced datasets. In this paper, we propose a new imbalanced encrypted traffic classification model. The proposed model is based on the improved convolutional block attention module (CBAM) and re-weighted cross-entropy focal loss (CEFL) function. The model exploits the redefined imbalance degree to construct a weight function, which is used to reassign the weights of the categories. The improved CBAM based on the redefined imbalance degree can make the model pay more attention to the characteristics of the minority samples, and increase the representation ability of these samples. The re-weighted CEFL loss function can be used to expand the effective loss gap between minority and majority samples. The method is validated on the public ISCX Tor 2016 dataset. The experimental results show that the performance of the new classification model is better than the baseline methods, and the proposed method can remarkably push the precision of the minority categories to 93.28% (14.63%↑), recall to 91.71% (16.98%↑), and F1 score to 92.49% (16.23%↑).

NRTAS: Non-redundant traffic authentication scheme for strengthening privacy in 5 G communication networks

End-to-end authentication in 5G communication networks is a prominent requirement due to the growing application demands and autonomously shared user data. The lack of data-related attributes and the communicating platform serves as a challenging issue in securing the shared content. Besides, administering security for the generated data is less feasible due to un-traceability and handoff experienced in the network. A Non-Redundant Traffic Authentication Scheme (NRTAS) is presented and the main objective of this proposed work provide a reliable authentication based on classifying the traffic. A traffic classification model is developed to categorize the traffic generated by the user equipment. A tree-based process is employed for linear and discrete authentication to enhance network performances. To succeed high connectivity secure 5G communication and information sharing in a heterogeneous platform is presented. The effectiveness of proposed NRTAS-5G communication network approach is executed in Opportunistic network environment (ONE) simulator version: 1.2. The NRTAS achieves 8.09% less access time, reduces the traffic load by 13.69%, and improves the success ratio by 5.36% for 150 UEs (User Equipment’s).

Network traffic classification using convolutional neural network and ant-lion optimization

Traffic identification has become a challenging task in recent years. Recently, deep learning methods have been extensively studied for network traffic classification recently. Unfortunately, these models require a large amount of training data. Another challenge with most traffic classification methods is that the features must be extracted by an expert. In these methods, finding the desired features that lead to a better classification is very tedious and time-consuming. In this regard, an excellent solution to address this challenge is to use of deep learning methods that automatically extract features. This paper is an attempt to address these issues by using a combination of the convolutional neural network (CNN), the ant-lion meta-heuristic algorithm (ALO), and the self-organizing map (SOM) to create a traffic classification model that can accurately identify traffic types. The proposed method was able to identify encrypted traffic and distinguish between VPN and non-VPN traffics. The model was evaluated using the “ISCX VPN-non-VPN” dataset, and achieved 98% accuracy.

Reinforcement Learning-Based Service-Oriented Dynamic Multipath Routing in SDN

The increasing quality and various requirements of network services are guaranteed because of the advancement of the emerging network paradigm, software-defined networking (SDN), and benefits from the centralized and software-defined architecture. The SDN not only facilitates the configuration of the network policies for traffic engineering but also brings convenience for network state obtainment. The traffic of numerous services is transmitted within a network, whereas each service may demand different network metrics, such as low latency or low packet loss rate. Corresponding quality of service policies must be enforced to meet the requirements of different services, and the balance of link utilization is also indispensable. In this research, Reinforcement Discrete Learning-Based Service-Oriented Multipath Routing (RED-STAR) has been proposed to understand the policy of distributing an optimal path for each service. The RED-STAR takes the network state and service type as input values to dynamically select the path a service must be forwarded. Custom protocols are designed for network state obtainment, and a deep learning-based traffic classification model is also integrated to identify network services. With the differentiated reward scheme for every service type, the reinforcement learning model in RED-STAR gradually achieves high reward values in various scenarios. The experimental results show that RED-STAR can adopt the dynamic network environment, obtaining the highest average reward value of 1.8579 and the lowest average maximum bandwidth utilization of 0.3601 among all path distribution schemes in a real-case scenario.

Improving Discriminating Accuracy Rate of DDoS Attacks and Flash Events

Internet security has become a big issue with the passage of time. Among many threats, the distributed denial-of-service (DDoS) attack is the most frequent threat in the networks. The purpose of the DDoS attacks is to interrupt service availability provided by different web servers. This results in legitimate users not being able to access the servers and hence facing denial of services. On the other hand, flash events are a high amount of legitimate users visiting a website due to a specific event. Consequences of these attacks are more powerful when launched during flash events, which are legitimate traffic and cause a denial of service. The purpose of this study is to build an intelligent network traffic classification model to improve the discrimination accuracy rate of DDoS attacks from flash events traffic. Weka is adopted as the platform for evaluating the performance of a random forest algorithm.

Network Intrusion Detection Based on an Efficient Neural Architecture Search

Deep learning has been applied in the field of network intrusion detection and has yielded good results. In malicious network traffic classification tasks, many studies have achieved good performance with respect to the accuracy and recall rate of classification through self-designed models. In deep learning, the design of the model architecture greatly influences the results. However, the design of the network model architecture usually requires substantial professional knowledge. At present, the focus of research in the field of traffic monitoring is often directed elsewhere. Therefore, in the classification task of the network intrusion detection field, there is much room for improvement in the design and optimization of the model architecture. A neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal. For this reason, we propose a model that can perform NAS in the field of network traffic classification and search for the optimal architecture suitable for traffic detection based on the network traffic dataset. Each layer of our depth model is constructed according to the principle of maximum coding rate attenuation, which has strong consistency and symmetry in structure. Compared with some manually designed network architectures, classification indicators, such as Top-1 accuracy and F1 score, are also greatly improved while ensuring the lightweight nature of the model. In addition, we introduce a surrogate model in the search task. Compared to using the traditional NAS model to search the network traffic classification model, our NAS model greatly improves the search efficiency under the premise of ensuring that the results are not substantially different. We also manually adjust some operations in the search space of the architecture search to find a set of model operations that are more suitable for traffic classification. Finally, we apply the searched model to other traffic datasets to verify the universality of the model. Compared with several common network models in the traffic field, the searched model (NAS-Net) performs better, and the classification effect is more accurate.

An Optimized K-means Clustering for Improving Accuracy in Traffic Classification

With the explosive grown network traffic, the traditional port- and payload-based methods are insatiable for the requirements of privacy protection as well as the fast real-time classification for the today traffic classification. Here, a network traffic classification model based on both the Self-Organizing Maps (SOM) and the K-means fusion algorithm is proposed. In which, the traffic data is initially clustered by the SOM network to derive the cluster number and each cluster center value. Then those values are taken as the initial parameters to run the K-means algorithm, achieving optimal classification. As results compared with the traditional K-means algorithm, the initially clustering done by using the SOM network not only inherits its advantages of simple method and efficient processing, but also reduces time cost. Moreover, a significant improvement in coossification accuracy is achieved with our proposed algorithm.

Classification method of IPv6 traffic based on convolutional neural network

This paper proposes a method of IPv6 traffic classification based on convolutional neural network. It aims to solve the problems of low accuracy, high dependence on traffic feature selection, inefficiency in IPv6 traffic classification technology based on machine learning, and the lack of research on IPv6 traffic classification methods. The method transforms IPv6 traffic into two-dimensional matrix as input of convolution neural network. Then, it constructs a traffic classification model of feature autonomous learning. The model consist of one input layer, two convolutional pooling layers, one full connection layer and one output layer. The experimental results show that the designed model has a good performance in IPv6 traffic classification.

RETRACTED ARTICLE: Research on network intrusion detection technology based on improved FCMA algorithm

In the process of science and technology development, although the control object is becoming more and more complex, the requirements for control performance are increasing. The contradiction of traditional control theory in FCMA algorithm is increasingly prominent in practical application, especially in robot control research and learning control, which is in urgent need of new vitality. At this time, a new control mode in the field of control, namely intelligent control, arises at the historic moment, which is a leap forward of control mode. In recent decades, the rapid development of the Internet and the development of a large scale, to avoid the belt to a variety of network intrusion, these network intrusion almost every moment. Network intrusion detection is an important way of computer security detection. It can identify the flow of external intrusion in the network, and carry out early warning processing. The network intrusion detection based on FCMA transforms the intrusion detection into the classification of network traffic, establishes a network traffic classification model, and classifies the network traffic by using machine learning classification standards, and detects the external intrusion traffic. Based on FCMA algorithm, this paper explores the method of network intrusion identification, and focuses on the data imbalance processing and feature selection in the process of network intrusion identification.

Traffic classification for efficient load balancing in server cluster using deep learning technique

Extensive use of multimedia services and Internet Data Center applications demand distributed deployment of these applications. It is implemented using edge computing with server clusters. To increase the availability of the services, applications are deployed redundantly in server clusters. In this situation, an efficient server allocation strategy is essential to improve execution fairness in server cluster. Categorizing the incoming traffic at server cluster is desired for the improvement of QoS. The traditional traffic classification models categorize the incoming traffic according to their applications’ type. They are ineffective in selection of suitable server, as they do not consider the characteristics of the server. Hence this paper proposes a classifier to assist the dispatcher to distribute the requests to appropriate server in server cluster. The proposed deep learning classification model based on incoming traffic characteristics and server status is reinforced with extended labelling using correlation based approach. The experimental results of the proposed classifier have shown considerable performance enhancement in terms of classification measures and waiting time of the requests compared to existing machine learning models.

Анализ влияния параметров алгоритмов Machine Learning на результаты классификации трафика в режиме реального времени

The paper analyzes the impact of setting the parameters of Machine Learning algorithms on the results of traffic classification in realtime. The Random Forest and XGBoost algorithms are considered. A brief description of the work of both methods and methods for evaluating the results of classification is given. Experimental studies are conducted on a database obtained on a real network, separately for TCP and UDP flows. In order for the results of the study to be used in real time, a special feature matrix is created based on the first 15 packets of the flow. The main parameters of the Random Forest (RF) algorithm for configuration are the number of trees, the partition criterion used, the maximum number of features for constructing the partition function, the depth of the tree, and the minimum number of samples in the node and in the leaf. For XGBoost, the number of trees, the depth of the tree, the minimum number of samples in the leaf, for features, and the percentage of samples needed to build the tree are taken. Increasing the number of trees leads to an increase in accuracy to a certain value, but as shown in the article, it is important to make sure that the model is not overfitted. To combat overfitting, the remaining parameters of the trees are used. In the data set under study, by eliminating overfitting, it was possible to achieve an increase in classification accuracy for individual applications by 11-12% for Random Forest and by 12-19% for XGBoost. The results show that setting the parameters is a very important step in building a traffic classification model, because it helps to combat overfitting and significantly increases the accuracy of the algorithm's predictions. In addition, it was shown that if the parameters are properly configured, XGBoost, which is not very popular in traffic classification works, becomes a competitive algorithm and shows better results compared to the widespread Random Forest.

Network Traffic Classification Model Based on Multi-Task Learning

A multi-task learning network traffic classification model (MTL-NTC) is experimentally studied. The identification task of the MTL-NTC model contains three tasks: identifying the type of traffic, predicting the bandwidth, and the duration of the flow. Identifying the type of traffic is the main task. It includes the classification of five types of traffic. The bandwidth prediction and the duration of the flow are auxiliary tasks, which are used to improve the performance of the main task. In the public network traffic data set QUIC, the MTL-NTC model and the common model are used for comparative experiments. The experimental results show that the recognition accuracy of this model is 97.33%, which is better than the common models.

Network Traffic Classification Using Deep Learning

The large amount of network traffic generated by Internet applications brings great challenges to Internet security. In order to facilitate network management and realize automatic classification of network traffic, this paper proposes a network traffic classification model NTCNET based on CNNs. Use open data set to do simulation verification experiment, then compare the test results with a variety of traditional classification methods. The experimental results shows that the constructed traffic classification model NTCNET has better precision, robustness and accuracy, with an accuracy of 99.66%.

FPGA Acceleration of CNNs-Based Malware Traffic Classification

With the rapid development of the Internet, malware traffic is seriously endangering the security of cyberspace. Convolutional neural networks (CNNs)-based malware traffic classification can automatically learn features from raw traffic, avoiding the inaccuracy of hand-design traffic features. Through the experiments and comparisons of LeNet, AlexNet, VGGNet, and ResNet, it is found that LeNet has good and stable classification ability for malware traffic and normal traffic. Then, a field programmable gate array (FPGA) accelerator for CNNs-based malware traffic classification is designed, which consists of a parameterized hardware accelerator and a fully automatic software framework. By fully exploring the parallelism between CNN layers, parallel computation and pipeline optimization are used in the hardware design to achieve high performance. Simultaneously, runtime reconfigurability is implemented by using a global register list. By encapsulating the underlying driver, a three-layer software framework is provided for users to deploy their pre-trained models. Finally, a typical CNNs-based malware traffic classification model was selected to test and verify the hardware accelerator. The typical application system can classify each traffic image from the test dataset in 18.97 μs with the accuracy of 99.77%, and the throughput of the system is 411.83 Mbps.

Detecting Behavioral Change of IoT Devices Using Clustering-Based Network Traffic Modeling

The Internet of Things (IoT) is increasingly becoming a major challenge for network administrators to manage connected devices and sensors ranging from smart lights to smoke alarms and security cameras, at scale. IoT devices use an extensive variety of firmware and provide little (or no) access for the management of their operating systems and configurations. Operators of the IoT infrastructure, therefore, need to employ traffic classification models (trained by historical data) to automatically detect their assets on the network and ensure the health of devices against cyber attacks by monitoring their network behavior. On the other hand, IoT manufacturers often automatically perform firmware upgrades from cloud servers to devices that are operational in the field. This can potentially lead to a change of device behavior which makes it difficult for network operators to maintain classification models (incorporating changes without retraining the entire model). In this article, we develop a modular device classification architecture that allows operators to automatically detect IoT devices by their network activity and dynamically accommodate legitimate changes in assets (either addition of new device profile or upgrade of existing profiles). Our contributions are threefold: 1) we identify key traffic attributes that can be obtained from flow-level network telemetry to characterize the behavior of various IoT device types. We develop an unsupervised one-class clustering method for each device to detect their normal network behavior; 2) we tune device-specific clustering models and use them to classify IoT devices from their network traffic in real time. We enhance our classification by developing methods for automatic conflict resolution and noise filtering; and 3) we evaluate the efficacy of our scheme by applying it to traffic traces (benign and attack) from ten real IoT devices and demonstrate its ability to detect behavioral changes with an overall accuracy of more than 94%.

Encrypted traffic classification based on Gaussian mixture models and Hidden Markov Models

To protect user privacy (e.g., IP address and sensitive data in a packet), many traffic protection methods, like traffic obfuscation and encryption technologies, are introduced. However, these methods have been used by attackers to transmit malicious traffic, posing a serious threat to network security. To enhance network traffic supervision, this paper proposes a new traffic classification model based on Gaussian mixture models and hidden Markov models, named MGHMM. To evaluate the effectiveness of the proposed model, we first classify protocols and identify the obfuscated traffic by experiments. Then, we compare the classification performance of MGHMM with that of the latest Vector Quantiser-based traffic classification algorithm. On the basis of the experiment, the relation between the classification and the number of hidden Markov states, and the number of mixture of Gaussian distributions required to describe the hidden states, are analyzed.

An Improved Network Traffic Classification Model Based on a Support Vector Machine

Network traffic classification based on machine learning is an important branch of pattern recognition in computer science. It is a key technology for dynamic intelligent network management and enhanced network controllability. However, the traffic classification methods still facing severe challenges: The optimal set of features is difficult to determine. The classification method is highly dependent on the effective characteristic combination. Meanwhile, it is also important to balance the experience risk and generalization ability of the classifier. In this paper, an improved network traffic classification model based on a support vector machine is proposed. First, a filter-wrapper hybrid feature selection method is proposed to solve the false deletion of combined features caused by a traditional feature selection method. Second, to balance the empirical risk and generalization ability of support vector machine (SVM) traffic classification model, an improved parameter optimization algorithm is proposed. The algorithm can dynamically adjust the quadratic search area, reduce the density of quadratic mesh generation, improve the search efficiency of the algorithm, and prevent the over-fitting while optimizing the parameters. The experiments show that the improved traffic classification model achieves higher classification accuracy, lower dimension and shorter elapsed time and performs significantly better than traditional SVM and the other three typical supervised ML algorithms.

A Network Traffic Classification Model Based on Metric Learning

Attacks on websites and network servers are among the most critical threats in network security. Network behavior identification is one of the most effective ways to identify malicious network intrusions. Analyzing abnormal network traffic patterns and traffic classification based on labeled network traffic data are among the most effective approaches for network behavior identification. Traditional methods for network traffic classification utilize algorithms such as Naive Bayes, Decision Tree and XGBoost. However, network traffic classification, which is required for network behavior identification, generally suffers from the problem of low accuracy even with the recently proposed deep learning models. To improve network traffic classification accuracy thus improving network intrusion detection rate, this paper proposes a new network traffic classification model, called ArcMargin, which incorporates metric learning into a convolutional neural network (CNN) to make the CNN model more discriminative. ArcMargin maps network traffic samples from the same category more closely while samples from different categories are mapped as far apart as possible. The metric learning regularization feature is called additive angular margin loss, and it is embedded in the object function of traditional CNN models. The proposed ArcMargin model is validated with three datasets and is compared with several other related algorithms. According to a set of classification indicators, the ArcMargin model is proofed to have better performances in both network traffic classification tasks and open-set tasks. Moreover, in open-set tasks, the ArcMargin model can cluster unknown data classes that do not exist in the previous training dataset.