Traffic classification plays an essential role in ensuring Quality of Service and network security. Recently, the development of traffic encryption technologies has rendered traditional methods based on ports and deep packet inspection ineffective. In recent years, deep learning-based solutions have been successful in classifying encrypted traffic by using time series, such as packet length sequence and timestamp sequence. However, there are still two shortcomings in existing studies. Firstly, the local and global timing features in the time series are not fully utilized. Secondly, the relationship between incoming and outgoing flows in a bidirectional flow (Bi-Flow) is not deeply explored. To address the shortcomings, we propose a novel scheme named FullView. It contains a traffic representation method called Bidirectional Grouping Matrices (BGM) and a two-path classification model. To fully utilize the local and global timing features, the packet length sequences are divided into groups. Two different encoders are designed to extract intra-group features and cross-group features respectively. To explore the interaction between outgoing and incoming flows, bidirectional matrices are designed to represent Bi-Flows. In the classification model, there are two separate paths to extract timing features from incoming and outgoing views and a fusion module to combine all features. To validate FullView, we conduct comparative experiments on three datasets. The results demonstrate that FullView achieves outstanding performance and outperforms the state-of-the-art schemes.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

FullView: Using Bidirectional Group Sequences to Achieve Accurate Encrypted Traffic Classification

  • Yuwei Xu,
  • Zhiyuan Liang,
  • Zhengxin Xu,
  • Kehui Song,
  • Qiao Xiang,
  • Guang Cheng

摘要

Traffic classification plays an essential role in ensuring Quality of Service and network security. Recently, the development of traffic encryption technologies has rendered traditional methods based on ports and deep packet inspection ineffective. In recent years, deep learning-based solutions have been successful in classifying encrypted traffic by using time series, such as packet length sequence and timestamp sequence. However, there are still two shortcomings in existing studies. Firstly, the local and global timing features in the time series are not fully utilized. Secondly, the relationship between incoming and outgoing flows in a bidirectional flow (Bi-Flow) is not deeply explored. To address the shortcomings, we propose a novel scheme named FullView. It contains a traffic representation method called Bidirectional Grouping Matrices (BGM) and a two-path classification model. To fully utilize the local and global timing features, the packet length sequences are divided into groups. Two different encoders are designed to extract intra-group features and cross-group features respectively. To explore the interaction between outgoing and incoming flows, bidirectional matrices are designed to represent Bi-Flows. In the classification model, there are two separate paths to extract timing features from incoming and outgoing views and a fusion module to combine all features. To validate FullView, we conduct comparative experiments on three datasets. The results demonstrate that FullView achieves outstanding performance and outperforms the state-of-the-art schemes.