Network traffic classification is the process of categorizing the network traffic into several traffic classes. It is an important problem that has various applications from identifying different types of network applications to malware traffic detection. In recent years, machine learning methods have been applied in network traffic classification. Most research uses structured statistical features extracted from network packet capture (PCAP) files, which were trained and tested with classic machine learning algorithms. These engineered features are useful, but they ignore some of the important details of individual packets. In this paper, we propose a method to encode the packets into images and use deep convolutional neural networks (CNN) to extract features automatically and identify the network traffic. Specifically, we encode the IP header information and duration between the packets of a sequence of packets in a traffic session into a single labeled image. We then use CNN to train and test millions of images generated using this approach. Many studies train and test machine learning models on the same dataset, which can result in poor performance when applied to different datasets. To test the effectiveness of our approach, we use datasets that come from multiple different sources. The accuracy and F1 scores show the proposed method provides accurate network traffic classification.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Classifying Network Traffic Using Images and Deep Convolutional Neural Networks

  • Qaylin I. Holliman,
  • R. E. Davis,
  • Jinsheng Xu,
  • Kaushik Roy

摘要

Network traffic classification is the process of categorizing the network traffic into several traffic classes. It is an important problem that has various applications from identifying different types of network applications to malware traffic detection. In recent years, machine learning methods have been applied in network traffic classification. Most research uses structured statistical features extracted from network packet capture (PCAP) files, which were trained and tested with classic machine learning algorithms. These engineered features are useful, but they ignore some of the important details of individual packets. In this paper, we propose a method to encode the packets into images and use deep convolutional neural networks (CNN) to extract features automatically and identify the network traffic. Specifically, we encode the IP header information and duration between the packets of a sequence of packets in a traffic session into a single labeled image. We then use CNN to train and test millions of images generated using this approach. Many studies train and test machine learning models on the same dataset, which can result in poor performance when applied to different datasets. To test the effectiveness of our approach, we use datasets that come from multiple different sources. The accuracy and F1 scores show the proposed method provides accurate network traffic classification.