A Weakly Supervised Method for Encrypted Traffic Classification in the Dark Web

With the widespread use of various data transmission encryption techniques, encrypting network traffic has become standard practice, especially in the dark web. Most security protection software and probes are designed for identifying unencrypted traffic, and they cannot effectively classify encrypted traffic from the dark web due to its unique anonymity. Existing methods do not comprehensively consider the external statistical features and the internal sequential features of the dark web traffic, thus perform poorly on fine-grained encrypted traffic classification tasks. To address these issues, in this paper, we conceive and implement a weakly supervised method, which not only eliminates the need to decrypt the encrypted payload into plaintext by automatically extracting external statistical features and internal sequential features from encrypted traffic, but also reduces the cost of annotating the whole dataset by a novel weakly-supervised manner. Specifically, we only need to label a very small amount of traffic session data based on expert knowledge, and then double-check the classification (clustering) results of LSTM model and DBSCAN, thereby continuously expanding the scale of the labeled data until all unlabeled traffic sessions are labeled. Experiments based on a real-world dataset from Tor validate the effectiveness of the proposed method.