Deep packet: a novel approach for encrypted traffic classification using deep learning

Abstract

Internet traffic classification has become more important with rapid growth of current Internet network and online applications. There have been numerous studies on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a deep learning based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both traffic characterization in which the network traffic is categorized into major classes (e.g., FTP and P2P) and application identification in which end-user applications (e.g., BitTorrent and Skype) identification is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. After an initial pre-processing phase on data, packets are fed into Deep Packet framework that embeds stacked autoencoder and convolution neural network in order to classify network traffic. Deep packet with CNN as its classification model achieved recall of 0.98 in application identification task and 0.94 in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.

Deep Learning for Encrypted Traffic Classification: An Overview

“…In pre-deep-learning era, fields including port number, protocol, and packet length, were carefully chosen by domain experts as representative features. In some recent approaches, especially deep-learning-based ones, entire packets are taken as input [11]. Note that server IP addresses might be used to limit the range of traffic classes for better accuracy in operational networks.…”

“…Moreover, they use nine statistical features of 12 intervals and both flow directions as an input. In [11], authors take header and payload data to train a 1-D CNN and a SAE model on ISCX VPN non-VPN dataset. Both models show high accuracy, but the CNN model marginally outperforms the SAE model.…”

“…Year Wang-2018 [9] Intrusion detection CNN+LSTM Header+payload 2018 Rezaei [3] APP/OS identification CNN Sampled time series 2018 Aceto [6] APP classification CNN/LSTM/SAE/MLP Header+payload 2018 Vu [10] Traffic identification AC-GAN Statistical 2017 Wang-2017 [7] Traffic identification CNN Header+payload 2017 Seq2Img [8] APP/protocol identification RKHS+CNN Time series 2017 Lotfollahi [11] APP/traffic identification CNN/SAE Header+payload 2017 Lopez-Martin [12] Mixed-type classification CNN+LSTM Header+time Series 2017 Hochst [13] Traffic identification Autoencoder Statistical+header 2017…”

“…Due to the high dimensionality of the input (large number of bytes in payload), classical ML methods and MLP do not work well. In such cases, CNN or combination of CNN and LSTM are reported to have high accuracy [7], [6], [11], [9]. It is possible to also use time series features alongside payload information to slightly improve accuracy, but this barely changes the input dimension or the choice of model.…”

Adversarial Attacks on Cognitive Self-Organizing Networks: The Challenge and the Way Forward

“…CNN has the capability to tolerate the distortion and spatial shifts in the input data and extract features from raw input data. CNN provides the state-of-the-art solution for network traffic feature extraction and classification [24], motivated by these successes, we explore the use of CNN for grayscale malware image classification.…”