ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

Lu, Bei; Luktarhan, Nurbol; Ding, Chao; Zhang, Wenhui

doi:10.3390/sym13061080

Cited by 31 publications

(27 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, the results are further improved. Lu et al [18] tried to combine CNN and LSTM, and proposed a model named ICLSTM (Inception-LSTM) for the classification of encrypted traffic. In their study, the raw encrypted traffic data was first converted into a grayscale image.…”

Section: Deep Learning Based Detection Methodsmentioning

confidence: 99%

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

Xin¹,

Zhang²,

Wang³

et al. 2023

Computer Modeling in Engineering &Amp; Sciences

View full text Add to dashboard Cite

The dark web is a shadow area hidden in the depths of the Internet, which is difficult to access through common search engines. Because of its anonymity, the dark web has gradually become a hotbed for a variety of cyber-crimes. Although some research based on machine learning or deep learning has been shown to be effective in the task of analyzing dark web traffic in recent years, there are still pain points such as low accuracy, insufficient real-time performance, and limited application scenarios. Aiming at the difficulties faced by the existing automated dark web traffic analysis methods, a novel method named Dark-Forest to analyze the behavior of dark web traffic is proposed. In this method, firstly, particle swarm optimization algorithm is used to filter the redundant features of dark web traffic data, which can effectively shorten the training and inference time of the model to meet the realtime requirements of dark web detection task. Then, the selected features of traffic are analyzed and classified using the DeepForest model as a backbone classifier. The comparison experiment with the current mainstream methods shows that Dark-Forest takes into account the advantages of statistical machine learning and deep learning, and achieves an accuracy rate of 87.84%. This method not only outperforms baseline methods such as Random Forest, MLP, CNN, and the original DeepForest in both large-scale and small-scale dataset based learning tasks, but also can detect normal network traffic, tunnel network traffic and anonymous network traffic, which may close the gap between different network traffic analysis tasks. Thus, it has a wider application scenario and higher practical value.

show abstract

Section: Deep Learning Based Detection Methodsmentioning

confidence: 99%

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

Xin¹,

Zhang²,

Wang³

et al. 2023

Computer Modeling in Engineering &Amp; Sciences

View full text Add to dashboard Cite

show abstract

“…CNN and Long-short term memory (LSTM) models are the most frequently used deep learning models for this task. The models are sometimes used together [8], [9], [10] or separately [4], [5]. These papers used various models to achieve different accuracies with different datasets.…”

Section: Previous Workmentioning

confidence: 99%

“…This creates a generalization problem as models tend to give uneven values of accuracy when tested with unseen data. Lu et al [8], used both CNN and LSTM for local and temporal feature extraction respectively. Both models were arranged in parallel, enabling features to be extracted and trained simultaneously, concatenated, then classified.…”

Section: Previous Workmentioning

confidence: 99%

See 1 more Smart Citation

A CNN Based Encrypted Network Traffic Classifier

Okonkwo

Foo

et al. 2022

Australasian Computer Science Week 2022

View full text Add to dashboard Cite

The internet is responsible for global connectivity and ensuring its safety is a paramount task for governments and organisations. Cybersecurity concerns led to the encryption of over 87% of internet traffic. Encryption ensures security by improving privacy between sender and receiver but creates a problem of in-accurate traffic classification. Previous papers have used Artificial Intelligence to address this problem, however issues such as model simplicity, complexity, imbalanced dataset etc, are problems yet to be addressed. Overfitting, underfitting and ultimately poor classification are outcomes of poorly designed models. This paper applies deep learning to the problem of encrypted traffic classification. A Convolutional Neural Network (CNN) is used to address this problem. An eleven layered architecture is designed and trained with a range of images generated from the metadata of encrypted traffic. At its core, the design is made less complex for understandability and deals with overfitting. The proposed model is assessed with the standard metrics of accuracy, precision, recall and 𝐹 1 score then compared to a baseline model. The model is trained and tested for seven classification problems, using three encryption types (https, vpn, tor). For all classification tasks, the proposed model achieved accuracies ranging from 91% -99%, which is an indication of optimum generalization strength. Our model outperformed the baseline model which had accuracies ranging from 67.6% -99%, an indication of poor generalization strength.

show abstract

“…In 2021, in Lu et al's work [35], the difficulties of traffic feature extraction efforts were avoided by focusing on DL to categorize network traffic as encrypted or not. The authors proposed an Inception-LSTM (ICLSTM) service to detect encrypted traffic, in which they converted the traffic data to gray images and then built an ICLSTM neural network to extract the important features and conduct effective traffic classification.…”

Section: Introductionmentioning

confidence: 99%

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

Al-Fayoumi¹,

Al-Fawa’reh²,

Nashwan³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

The continual growth of the use of technological appliances during the COVID-19 pandemic has resulted in a massive volume of data flow on the Internet, as many employees have transitioned to working from home. Furthermore, with the increase in the adoption of encrypted data transmission by many people who tend to use a Virtual Private Network (VPN) or Tor Browser (dark web) to keep their data privacy and hidden, network traffic encryption is rapidly becoming a universal approach. This affects and complicates the quality of service (QoS), traffic monitoring, and network security provided by Internet Service Providers (ISPs), particularly for analysis and anomaly detection approaches based on the network traffic's nature. The method of categorizing encrypted traffic is one of the most challenging issues introduced by a VPN as a way to bypass censorship as well as gain access to geo-locked services. Therefore, an efficient approach is especially needed that enables the identification of encrypted network traffic data to extract and select valuable features which improve the quality of service and network management as well as to oversee the overall performance. In this paper, the classification of network traffic data in terms of VPN and non-VPN traffic is studied based on the efficiency of time-based features extracted from network packets. Therefore, this paper suggests two machine learning models that categorize network traffic into encrypted and non-encrypted traffic. The proposed models utilize statistical features (SF), Pearson Correlation (PC), and a Genetic Algorithm (GA), preprocessing the traffic samples into net flow traffic to accomplish the experiment's objectives. The GA-based method utilizes a stochastic method based on natural genetics and biological evolution to extract essential features. The PC-based method performs well in removing different features of network traffic. With a microsecond perpacket prediction time, the best model achieved an accuracy of more than 95.02 percent in the most demanding traffic classification task, a drop in accuracy of only 2.37 percent in comparison to the entire statistical-based machine learning approach. This is extremely promising for the development of real-time traffic analyzers.

show abstract

ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

Cited by 31 publications

References 38 publications

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

A CNN Based Encrypted Network Traffic Classifier

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

Contact Info

Product

Resources

About