Traffic Classification Research Articles

Network Traffic Classification Against Adversarial Attacks Based Deep Learning

Background: Cybersecurity is a prominent concern in today's interconnected world, encompassing both local and remote wireless and wired access across diverse communication technology platforms. It is important to recognize the threat posed by hackers who are currently compromising organizational functionalities, bypassing security measures, and stealing hypersensitive information. Common hacking techniques such as Portscan, Distributed Denial of Service (DDoS) attacks, and the use of Botnets, are frequently utilized by hackers. Materials and Methods: The authors explore the advantages of using Machine Learning (ML) to classify attacks such as Port Scanning, DDoS, Botnet, and Botnet-Attempt in a mixture of both benign and attack traffic. They use various Artificial Neural Networks (ANN) structures, each having distinct properties, to train and test on a benchmark dataset (CICIDS2017). The aim is to identify the most effective ANN model and the optimal number of input features required to classify data that contains events of Portscan, DDoS, Botnet, and Botnet-Attempt attacks. Results: Various features are used as inputs for an ML model with single and multiple hidden layers, each with different neurons, to evaluate their impact on classification accuracy using a Python language. The best accuracy obtained is 99.71%, achieved by using all features of the dataset and 4 hidden layers, while the accuracy obtained using only 7 features is 97.6%. Conclusion: ANN models can perform well in classifying network traffic against adversarial attacks by using an optimal combination of features as input and hidden layers.

Traffic data classification in SDN network based on machine learning algorithms

Traffic classification plays a crucial role in various domains of network management, including service measurement, architectural design, security monitoring, and advertising. Software-defined networks (SDN) is a new technology that has the potential to solve typical network problems by simplifying network management, the introduction of network programmability, and the provision of a global perspective of a network. In recent years, SDN has brought new opportunities to classify traffic. Traffic classification techniques in SDN have been investigated, proposed, and developed. This survey delves into traffic classification under SDN, which is a vital component for improving network services, administration, and security. We give an in-depth assessment of traffic categorization algorithms adapted for SDN, emphasizing the fresh opportunities and problems they present. We cover the many metrics for assessing the effectiveness of these traffic classification algorithms, such as accuracy, precision, recall, and F1 score, and we examine the numerous datasets that serve as performance benchmarks. The study also synthesizes the findings of existing research, revealing trends and the efficacy of various techniques in the context of SDN-enabled settings. This document serves as a resource for scholars and practitioners seeking to optimize traffic classification strategies by providing a complete review and assessment of existing traffic classification approaches

NetDiffus: Network traffic generation by diffusion models through time-series imaging

While Machine-Learning based network data analytics are now commonplace for many networking solutions, nonetheless, limited access to appropriate networking data has been an enduring challenge for many networking problems. Causes for lack of such data include complexity of data gathering, commercial sensitivity, as well as privacy and regulatory constraints. To overcome these challenges, we present a Diffusion-Model (DM) based end-to-end framework, NetDiffus, for synthetic network traffic generation which is one of the emerging topics in networking and computing system. NetDiffus first converts one-dimensional time-series network traffic into two-dimensional images, and then synthesizes representative images for the original data. We demonstrate that NetDiffus outperforms the state-of-the-art traffic generation methods based on Generative Adversarial Networks (GANs) by providing 66.4% increase in the fidelity of the generated data and an 18.1% increase in downstream machine learning tasks. We evaluate NetDiffus on seven diverse traffic traces and show that utilizing synthetic data significantly improves several downstream ML tasks including traffic fingerprinting, anomaly detection and traffic classification. The code has been included at https://github.com/Nirhoshan/NetDiffus.

SDR Image Reconstruction for the Improvement of Nighttime Traffic Classification Using a New HDR Traffic Dataset

SDR Image Reconstruction for the Improvement of Nighttime Traffic Classification Using a New HDR Traffic Dataset

A novel and effective encrypted traffic classification method based on channel attention and deformable convolution

With the rapid development of the Internet and 5G communication technologies, encrypted traffic classification, recognized as a fundamental task in network management, has gained increasing attention from researchers. An accurate traffic classification is crucial for improving network service quality, optimizing network operations, and ensuring information security. However, most of the existing neural network-based methods lack attention to key information and have insufficient traffic feature extraction capability. Motivated by the above limitations, we proposed a novel and effective end-to-end model based on channel attention and deformable convolution, called CAD-Net. Specifically, a novel channel attention mechanism and a powerful deformable convolution technique are introduced in the residual network, which provides the model with the capability of focusing on the most relevant features and capturing the implicit features among the traffic bytes. Furthermore, our class-aware weighted cross-entropy loss function significantly improves the performance of CAD-Net under class-imbalanced conditions. We comprehensively evaluated the effectiveness of CAD-Net on two public datasets, and the experimental results demonstrate that our model achieved the best performance compared with existing methods on both encrypted traffic service and application classification tasks.

Network Information Security Monitoring Under Artificial Intelligence Environment

At present, network attack means emerge in endlessly. The detection technology of network attack must be constantly updated and developed. Based on this, the two stages of network attack detection (feature selection and traffic classification) are discussed. The improved bat algorithm (O-BA) and the improved random forest algorithm (O-RF) are proposed for optimization. Moreover, the NIS system is designed based on the Agent concept. Finally, the simulation experiment is carried out on the real data platform. The results showed that the detection precision, accuracy, recall, and F1 score of O-BA are significantly higher than those of references [17], [18], [19], and [20], while the false positive rate is the opposite (P < 0.05). The detection precision, accuracy, recall, and F1 score of O-RF algorithm are significantly higher than those of Apriori, ID3, SVM, NSA, and O-RF algorithm, while the false positive rate is significantly lower than that of Apriori, ID3, SVM, NSA, and O-RF algorithm (P < 0.05).

A filter-and-refine approach to lightweight application traffic classification

As application traffic becomes increasingly complex and voluminous, the need for accurate and fast traffic classification is emphasized, leading to proposals for lightweighting DL-based classifier. Nevertheless, there is still a need for faster and more accurate classification methods for practical deployment. We propose a new traffic classification mechanism using the Filter-and-Refine approach. The proposed method was evaluated public dataset using seven baselines and showed 4%p higher accuracy and about 39 times faster classification speed compared to the state-of-the-art. The source code and dataset are available at https://github.com/pb1069/Network-Traffic-Classification.

APPLICATION OF ARTIFICIAL INTELLIGENCE MODELS IN 5G AND 6G COMMUNICATION NETWORKS FOR NETWORK TRAFFIC CLASSIFICATION

An overview of artificial intelligence and machine learning models that can be adapted or used for traffic classification in 5G and 6G networks is provided. Emphasis is placed on convolutional neural networks, designed to handle data with a constant network topology. Given this feature, the need to transform traffic data into formats suitable for convolutional neural networks is outlined. Models capable of traffic classification, such as LeNet-5, AlexNet, VGGNet, ResNet, 1D CNN, Inception (GoogleNet), MobileNet, and Capsule Networks are proposed. Their features, advantages, and disadvantages are summarized. The structure of 6G networks is proposed. A description of the levels of 6G networks is given, and the tasks to be solved by artificial intelligence at each level are outlined. Specific neural network architectures and existing algorithms for 6G networks are listed, including authors, year of creation, and main articles on the topic, with features. The conceptual place of artificial intelligence in 6G networks is described, considering the type of centralization. Positive and negative consequences from the implementation of artificial intelligence in 6G networks are highlighted.

MTSecurity: Privacy-Preserving Malicious Traffic Classification Using Graph Neural Network and Transformer

MTSecurity: Privacy-Preserving Malicious Traffic Classification Using Graph Neural Network and Transformer

Self-Supervised Traffic Classification: Flow Embedding and Few-Shot Solutions

Self-Supervised Traffic Classification: Flow Embedding and Few-Shot Solutions

A Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification

A Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification

AutoML4ETC: Automated Neural Architecture Search for Real-World Encrypted Traffic Classification

AutoML4ETC: Automated Neural Architecture Search for Real-World Encrypted Traffic Classification

HSS: enhancing IoT malicious traffic classification leveraging hybrid sampling strategy

Using deep learning models to deal with the classification tasks in network traffic offers a new approach to address the imbalanced Internet of Things malicious traffic classification problems. However, the employment difficulty of these models may be immense due to their high resource consumption and inadequate interpretability. Fortunately, the effectiveness of sampling methods based on the statistical principles in imbalance data distribution indicates the path. In this paper, we address these challenges by proposing a hybrid sampling method, termed HSS, which integrates undersampling and oversampling techniques. Our approach not only mitigates the imbalance in malicious traffic but also fine-tunes the sampling threshold to optimize performance, as substantiated through validation tests. Employed across three distinct classification tasks, this method furnishes simplified yet representative samples, enhancing the baseline models’ classification capabilities by a minimum of 6.02% and a maximum of 182.66%. Moreover, it notably reduces resource consumption, with sample numbers diminishing to a ratio of at least 83.53%. This investigation serves as a foundation, demonstrating the efficacy of HSS in bolstering security measures in IoT networks, potentially guiding the development of more adept and resource-efficient solutions.

GateKeeper: An UltraLite malicious traffic identification method with dual-aspect optimization strategies on IoT gateways

The Internet of Things (IoT) landscape is booming, and a wide range of IoT endpoints has been integrated into various aspects of life, opening opportunities for malicious attacks that compromise IoT security. Consequently, effective malicious traffic identification methods play a crucial role in ensuring IoT security. However, the current lightweight methods face two main challenges. Firstly, they often generate feature sets that are time-consuming to construct and less adaptable to various scenarios. Secondly, classification models built upon inefficient neural networks incur a significant computational overhead. To address these drawbacks, in this work, we propose GateKeeper, which is an UltraLite method for malicious traffic identification on the IoT gateway. We first propose a base model as the cornerstone and target for subsequent optimization. Then we propose dual-aspect optimization strategies for reducing the input dimension and simplifying the model structure, i.e., Key Bytes Selection (KBS) and Attention Module Simplification (AMS) strategy. Finally, we obtain the optimized UltraLite model-GateKeeper, specifically tailored for integration into IoT gateway deployments, where high-speed real-time identification is paramount. Our extensive experiments demonstrate that GateKeeper performs remarkably in identifying malicious IoT traffic, achieving over 97% accuracy in all three IoT malicious traffic classification benchmark tasks, outperforming six state-of-the-art methods. Besides, GateKeeper’s parameters and FLOPs are 65% smaller than those of existing methods. Moreover, in the case of an IoT gateway platform, GateKeeper demonstrates remarkably low time overhead and hardware resource utilization, surpassing state-of-the-art methods.

Enhancing IoT Security: A Blockchain-Based Mitigation Framework for Deauthentication Attacks

The proposed Blockchain-Based Mitigation of Deauthentication Attacks (BBMDA) Framework aims to enhance the security and trustworthiness of IoT environments by leveraging blockchain technology, the Elliptic Curve Digital Signature Algorithm (ECDSA) for secure authentication, and Multi-Task Transformer (MTT) for efficient traffic classification. This paper presents a novel approach to mitigate de-authentication attacks in IoT ecosystems. The research methodology involves developing and implementing the BBMDA framework, followed by a comprehensive evaluation and comparison with existing techniques. Key findings indicate that the BBMDA framework outperforms traditional methods such as Support Vector Machine (SVM), k-nearest Neighbors (KNN), and Convolutional Neural Network (CNN) in terms of accuracy, false positive rate, false negative rate, precision, recall, and F1-score. These results underscore the effectiveness and efficiency of the proposed framework in enhancing IoT security.

LAMBERT: Leveraging Attention Mechanisms to Improve the BERT Fine-Tuning Model for Encrypted Traffic Classification

Encrypted traffic classification is a crucial part of privacy-preserving research. With the great success of artificial intelligence technology in fields such as image recognition and natural language processing, how to classify encrypted traffic based on AI technology has become an attractive topic in information security. With good generalization ability and high training accuracy, pre-training-based encrypted traffic classification methods have become the first option. The accuracy of this type of method depends highly on the fine-tuning model. However, it is a challenge for existing fine-tuned models to effectively integrate the representation of packet and byte features extracted via pre-training. A novel fine-tuning model, LAMBERT, is proposed in this article. By introducing an attention mechanism to capture the relationship between BiGRU and byte sequences, LAMBERT not only effectively improves the sequence loss phenomenon of BiGRU but also improves the processing performance of encrypted stream classification. LAMBERT can quickly and accurately classify multiple types of encrypted traffic. The experimental results show that our model performs well on datasets with uneven sample distribution, no pre-training, and large sample classification. LAMBERT was tested on four datasets, namely, ISCX-VPN-Service, ISCX-VPN-APP, USTC-TFC and CSTNET-TLS 1.3, and the F1 scores reached 99.15%, 99.52%, 99.30%, and 97.41%, respectively.

Network intrusion detection leveraging multimodal features

Network Intrusion Detection Systems (NIDSes) are essential for safeguarding critical information systems. However, the lack of adaptability of Machine Learning (ML) based NIDSes to different environments could cause slow adoption. In this paper, we propose a multimodal NIDS that combines flow and payload features to detect cyber-attacks. The focus of the paper is to evaluate the use of multimodal traffic features in detecting attacks, but not on a practical online implementation. In the multimodal NIDS, two random forest models are trained to classify network traffic using selected flow-based features and the first few bytes of protocol payload, respectively. Predictions from the two models are combined using a soft voting approach to get the final traffic classification results. We evaluate the multimodal NIDS using flow-based features and the corresponding payloads extracted from Packet Capture (PCAP) files of a publicly available UNSW-NB15 dataset. The experimental results show that the proposed multimodal NIDS can detect most attacks with average Accuracy, Recall, Precision and F1 scores ranging from 98% to 99% using only six flow-based traffic features, and the first 32 bytes of protocol payload. The proposed multimodal NIDS provides a reliable approach to detecting cyber-attacks in different environments.

Self-Supervised Learning Malware Traffic Classification Based on Masked Autoencoder

Self-Supervised Learning Malware Traffic Classification Based on Masked Autoencoder

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

Distributed denial-of-service (DDoS) attacks persistently proliferate, impacting individuals and Internet Service Providers (ISPs). Deep learning (DL) models are paving the way to address these challenges and the dynamic nature of potential threats. Traditional detection systems, relying on signature-based techniques, are susceptible to next-generation malware. Integrating DL approaches in cloud-edge/federated servers enhances the resilience of these systems. In the Internet of Things (IoT) and autonomous networks, DL, particularly federated learning, has gained prominence for attack detection. Unlike conventional models (centralized and localized DL), federated learning does not require access to users’ private data for attack detection. This approach is gaining much interest in academia and industry due to its deployment on local and global cloud-edge models. Recent advancements in DL enable training a quality cloud-edge model across various users (collaborators) without exchanging personal information. Federated learning, emphasizing privacy preservation at the cloud-edge terminal, holds significant potential for facilitating privacy-aware learning among collaborators. This paper addresses: (1) The deployment of an optimized deep neural network for network traffic classification. (2) The coordination of federated server model parameters with training across devices in IoT domains. A federated flowchart is proposed for training and aggregating local model updates. (3) The generation of a global model at the cloud-edge terminal after multiple rounds between domains and servers. (4) Experimental validation on the BoT-IoT dataset demonstrates that the federated learning model can reliably detect attacks with efficient classification, privacy, and confidentiality. Additionally, it requires minimal memory space for storing training data, resulting in minimal network delay. Consequently, the proposed framework outperforms both centralized and localized DL models, achieving superior performance.

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis.

The widespread use of encrypted traffic poses challenges to network management and network security. Traditional machine learning-based methods for encrypted traffic classification no longer meet the demands of management and security. The application of deep learning technology in encrypted traffic classification significantly improves the accuracy of models. This study focuses primarily on encrypted traffic classification in the fields of network analysis and network security. To address the shortcomings of existing deep learning-based encrypted traffic classification methods in terms of computational memory consumption and interpretability, we introduce a Parameter-Efficient Fine-Tuning method for efficiently tuning the parameters of an encrypted traffic classification model. Experimentation is conducted on various classification scenarios, including Tor traffic service classification and malicious traffic classification, using multiple public datasets. Fair comparisons are made with state-of-the-art deep learning model architectures. The results indicate that the proposed method significantly reduces the scale of fine-tuning parameters and computational resource usage while achieving performance comparable to that of the existing best models. Furthermore, we interpret the learning mechanism of encrypted traffic representation in the pre-training model by analyzing the parameters and structure of the model. This comparison validates the hypothesis that the model exhibits hierarchical structure, clear organization, and distinct features.