Encrypted traffic classification method based on convolutional neural network

Rongna XIE; Zhuhong MA; Zongyu LI; Ye TIAN

doi:10.11959/j.issn.2096-109x.2022077

您当前的位置：

首页 >

文章列表页 >

Encrypted traffic classification method based on convolutional neural network

Papers and Reports | 更新时间：2024-06-03

- Encrypted traffic classification method based on convolutional neural network
- Chinese Journal of Network and Information Security Vol. 8, Issue 6, Pages: 84-91(2022)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2022077
  CLC： TP393
- Online First：2022-12，
  
  Published：15 December 2022
- 稿件说明：
移动端阅览
Rongna XIE, Zhuhong MA, Zongyu LI, et al. Encrypted traffic classification method based on convolutional neural network[J]. Chinese Journal of Network and Information Security, 2022, 8(6): 84-91.
DOI：

Rongna XIE, Zhuhong MA, Zongyu LI, et al. Encrypted traffic classification method based on convolutional neural network[J]. Chinese Journal of Network and Information Security, 2022, 8(6): 84-91. DOI： 10.11959/j.issn.2096-109x.2022077.

摘要

针对传统加密网络流量分类方法准确率较低、泛用性不强、易侵犯隐私等问题，提出了一种基于卷积神经网络的加密流量分类方法，避免依赖原始流量数据，防止过度拟合特定应用程序的字节结构。针对网络流量的数据包大小和到达时间信息，设计了一种将原始流量转换为二维图片的方法，直方图中每个单元格代表到达相应时间间隔的具有相应大小数据包的数量，不依赖数据包有效载荷，避免了侵犯隐私；针对LeNet-5卷积神经网络模型进行了优化以提高分类精度，嵌入Inception模块进行多维特征提取并进行特征融合，使用1*1卷积来控制输出的特征维度；使用平均池化层和卷积层替代全连接层，提高计算速度且避免过拟合；使用对象检测任务中的滑动窗口方法，将每个网络单向流划分为大小相等的块，确保单个会话中训练集中的块和测试集中的块没有重叠，扩充了数据集样本。在ISCX数据集上的分类实验结果显示，针对应用流量分类任务，准确率达到了 95%以上。对比实验结果表明，训练集和测试集类型不同时，传统分类方法出现了显著的精度下降乃至失效，而所提方法的准确率依然达到了89.2%，证明了所提方法普适于加密流量与非加密流量。进行的所有实验均基于不平衡数据集，如果对数据集进行平衡化处理，准确率可能会进一步提高。

Abstract

Aiming at the problems of low accuracy

weak generality

and easy privacy violation of traditional encrypted network traffic classification methods

an encrypted traffic classification method based on convolutional neural network was proposed

which avoided relying on original traffic data and prevented overfitting of specific byte structure of the application.According to the data packet size and arrival time information of network traffic

a method to convert the original traffic into a two-dimensional picture was designed.Each cell in the histogram represented the number of packets with corresponding size that arrive at the corresponding time interval

avoiding reliance on packet payloads and privacy violations.The LeNet-5 convolutional neural network model was optimized to improve the classification accuracy.The inception module was embedded for multi-dimensional feature extraction and feature fusion.And the 1*1 convolution was used to control the feature dimension of the output.Besides

the average pooling layer and the convolutional layer were used to replace the fully connected layer to increase the calculation speed and avoid overfitting.The sliding window method was used in the object detection task

and each network unidirectional flow was divided into equal-sized blocks

ensuring that the blocks in the training set and the blocks in the test set in a single session do not overlap and expanding the dataset samples.The classification experiment results on the ISCX dataset show that for the application traffic classification task

the average accuracy rate reaches more than 95%.The comparative experimental results show that the traditional classification method has a significant decrease in accuracy or even fails when the types of training set and test set are different.However

the accuracy rate of the proposed method still reaches 89.2%

which proves that the method is universally suitable for encrypted traffic and non-encrypted traffic.All experiments are based on imbalanced datasets

and the experimental results may be further improved if balanced processing is performed.

关键词

Keywords

references

李艳霞 , 柴毅 , 胡友强 , 等 . 不平衡数据分类方法综述 [J ] . 控制与决策 , 2019 , 34 ( 4 ): 673 - 688 .

LI Y X , CAI Y , HU Y Q , et al . A summary of the classification methods of unbalanced data [J ] . Control and decision-making , 2019 , 34 ( 4 ): 673 - 688 .

王攀 , 陈雪娇 . 基于堆栈式自动编码器的加密流量识别方法 [J ] . 计算机工程 , 2018 , 44 ( 11 ): 140 - 147 .

WANG P , CHEN X J . Encrypted traffic identification method based on stack automatic encoder [J ] . Computer Engineering , 2018 , 44 ( 11 ): 140 - 147 .

FINSTERBUSCH M , RICHTER C , ROCHA E , et al . A survey of payload-based traffic classification approaches [J ] . IEEE Communications Surveys ＆ Tutorials , 2014 , 16 ( 2 ): 1135 - 1156 .

DAINOTTI A , PESCAPE A , CLAFFY K C . Issues and future directions in traffic classification [J ] . Network IEEE , 2012 , 26 ( 1 ): 35 - 40 .

骆子铭 , 许书彬 , 刘晓东 . 基于机器学习的TLS恶意加密流量检测方案 [J ] . 网络与信息安全学报 , 2020 , 6 ( 1 ): 77 - 83 .

LUO Z M , XU S B , LIU X D . TLS malicious encryption traffic detection scheme based on machinelearning [J ] . Journal of Network and Information Security , 2020 , 6 ( 1 ): 77 - 83 .

REZAEI S , LIU X . Deep learning for encrypted traffic classification:an overview [J ] . IEEE Communications Magazine , 2019 , 57 ( 5 ): 76 - 81 .

WEI W , MING Z , WANG J , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . 2017 : 43 - 48 .

XIAO X , XIAO W , LI R , et al . EBSNN:extended byte segment neural network for network traffic classification [J ] . IEEE Transactions on Dependable and Secure Computing , 2021 , 10 ( 1 ).

朱文斌 , 马秀丽 . 多种构图方式下的加密流量分类 [J ] . 电子测量技术 , 2021 , 44 ( 12 ): 87 - 92 .

ZHU W B , MA X l . Classification of encrypted traffic under multiple composition methods [J ] . Electronic Measurement Technology , 2021 , 44 ( 12 ): 87 - 92 .

REZAEI S , LIU X . How to achieve high classification accuracy with just a few labels:a semi-supervised approach using sampled packets [J ] . arXiv preprint arXiv:1812.09761 , 2018 .

LOTFOLLAHI M , JAFARI SIAVOSHANI M , SHIRALI HOSSEIN ZADE R , et al . Deep packet:a novel approach for encrypted traffic classification using deep learning [J ] . Soft Computing , 2020 , 24 ( 3 ): 1999 - 2012 .

CHEN Z , HE K , LI J , et al . Seq2img:a sequence-to-image based approach towards ip traffic classification using convolutional neural networks [C ] // 2017 IEEE International Conference on Big Data . 2017 : 1271 - 1276 .

ERTAM F , AVCI E . A new approach for internet traffic classification:GA-WK-ELM [J ] . Measurement , 2017 , 95 : 135 - 142 .

LOPEZ-MARTIN M , CARRO B , SANCHEZ-ESGUEVILLAS A , , et al . Network traffic classifier with convolutional and recurrent neural networks for internet of things [J ] . IEEE Access , 2017 ,( 99 ): 1 - 1 .

WANG W , ZHU M , ZENG X , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // 2017 International conference on information networking (ICOIN) . 2017 : 712 - 717 .

DRAPER-GIL G , LASHKARI A H , MAMUN M S I , et al . Characterization of encrypted and VPN traffic using time-related [C ] // Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP) . 2016 : 407 - 414 .

SZEGEDY C , TOSHEV A , ERHAN D . Deep neural networks for object detection [J ] . Advances in Neural Information Processing Systems , 2013 :26.

Views

585

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-feature fusion malware detection method based on attention and gating mechanisms

Survey of encrypted malicious traffic detection based on deep learning

Multi-source forgery detection method based on the fusion of color space features and frequency domain features

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

Related Author

Zhongyuan CHEN

Jianbiao ZHANG

Mingfang ZHAI

Xingming ZHANG

Bo ZHAO

Hou Yifan

Miao Zhuang

Wang Jun

Related Institution

Institute of Command-and-Control Engineering, Army Engineering University of PLA

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

⁰