STFNT: An encrypted traffic classification method integrating TLS handshake features and spatiotemporal characteristics

With the widespread adoption of encryption technologies, traditional traffic classification methods are facing increasingly severe challenges when handling encrypted traffic. To address the heavy reliance of conventional machine learning approaches on expert knowledge, as well as the limitations of existing deep learning methods in the feature extraction process of encrypted traffic, this paper proposes a feature engineering method oriented towards encrypted network protocols, and designs an encrypted traffic classification neural network architecture based on CNN and LSTM (STFNT). In the preprocessing stage, we remove overt sensitive features such as SNI and cipher suites, only select packet size and flow arrival time, which are the two features unaffected by encryption, and meanwhile, combine the TLS handshake header byte features to construct a robust feature set. Specifically, CNN is used to extract local byte pattern features from the TLS handshake headers, and LSTM is used to model the spatio-temporal feature sequence composed of packet size and flow arrival time, which is used to compensate for the information loss caused by traffic truncation. To validate the effectiveness of the proposed method, experimental evaluations are conducted on the ISCX VPN-nonVPN2016, USTC-TFC2016, and a self-built SUSE dataset. The experimental results demonstrate that the STFNT method achieves overall classification accuracies of 98.60%, 99.93%, and 98.58% on the three datasets, respectively, outperforming various mainstream models used for comparison.