Zero-Recollecting Mobile-App Identification over Drifted Encrypted Network Traffic

Mobile-app identification over encrypted network traffic is crucial in managing network, ensuring cybersecurity, and analyzing advertising. Combining machine learning classifiers and traffic features is the mainstream approach, which always assumes the training and test traffic is independent and identically distributed. However, in many real scenarios, the test traffic could dynamically change and drift out of the training distribution, resulting in obvious performance degradation. Existing methods recollect the drifted samples, and then minimize the differences between distributions or directly retrain the classifiers from scratch. However, collecting drifted traffic is labor-intensive and cannot cover all possible drifted scenarios, which restrict the deployment. In this paper, we propose a Flow causal Neural Network (FCNN) to improve the performance in identifying mobile apps in drifted scenarios under zero-recollecting. The FCNN concentrates on more robust associations between features and labels which persists invariant for drifted samples, and mitigates spurious correlations which is unstable via reweighting training traces. In addition, FCNN expands the seen feature space by randomizing the discriminative features to enhance the robustness against potential distribution drifts. In the extensive experiments on two public datasets, our FCNN achieves a remarkable improvement (4.68% \(\sim \) 23.56% \(\uparrow \) in \(F_1\) ) with zero-recollecting and outperforms other comparisons.