MATEC: A lightweight neural network for online encrypted traffic classification

Cheng, Jin; Wu, Yulei; Yuepeng, E; You, Jinmao; Li, Tong; Li, Hui; Ge, Jingguo

doi:10.1016/j.comnet.2021.108472

Cited by 46 publications

(21 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It allows AB-RF to achieve low training time and high prediction throughput. Simultaneously, AB-RF outperforms the best known from the literature classifiers, namely, BGRUA [10] and MATEC [11] in classification quality. • We introduce the recomposition algorithm for TLS Hello messages to place TLS parameters on the same positions for different handshakes.…”

Section: Introductionmentioning

confidence: 85%

“…Obviously, ECH prevents SNI-based classification. However, many studies show that Neural Network (NN) algorithms that analyze TLS handshake payload bytes provide QoS-aware classification even with hidden SNI [10], [11]. In Section III-D, we discuss them in more details.…”

Section: ) Qos Provisioningmentioning

confidence: 99%

“…So, packet features extracted with CNN served as input to the long-short term memory (LSTM) network to keep features of the flow. The authors used a lightweight CNN with only one dense layer to improve the overall F T NOTE: Here, F is the f-score value, and T is the prediction throughput value of the MATEC algorithm according to [11].…”

Section: State-of-the-art In Tls Payload-based Tcmentioning

confidence: 99%

See 2 more Smart Citations

Is Encrypted ClientHello a Challenge for Traffic Classification?

et al. 2022

View full text Add to dashboard Cite

Although the widely-used Transport Layer Security (TLS) protocol hides application data, an unencrypted part of the TLS handshake, specifically the server name indication (SNI), is a backdoor for encrypted traffic classification frameworks. The recently developed Encrypted ClientHello (ECH) amendment to the TLS protocol aims to protect the privacy-sensitive content of the ClientHello message, including SNI. Conversely, ECH can be a game-changer in the early detection of encrypted traffic. The paper shows that the performance of the state-of-the-art traffic classification algorithms degrades significantly with the introduction of the ECH. Hence, novel approaches to real-time traffic classification are required. The paper develops two novel traffic classification algorithms to address this challenge. The first one uses unencrypted bytes of the TLS Hello messages as independent features of the Random Forest algorithm. It is extremely lightweight and suits throughput-focused traffic classification. It is faster than state-of-the-art algorithms by three times and achieves higher classification quality. The second algorithm augments the approach of the first one by focusing on the particular metadata of the handshake. This way, it efficiently extracts data from the exchange and achieves the highest classification quality in all the considered scenarios. It has a three times lower error rate than state-of-the-art algorithms and provides a reliable classification of ECH traffic.

show abstract

Section: Introductionmentioning

confidence: 85%

Section: ) Qos Provisioningmentioning

confidence: 99%

Section: State-of-the-art In Tls Payload-based Tcmentioning

confidence: 99%

See 1 more Smart Citation

Is Encrypted ClientHello a Challenge for Traffic Classification?

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Guo et al [5] propose two deep learningbased models for VPN traffic detection and VPN traffic classification, i.e., convolutional auto-encoding (CAE) and convolutional neural network (CNN). Cheng et al [6] design a lightweight model for online encrypted traffic classification. The number of parameters and training time of the model are significantly reduced.…”

Section: Related Workmentioning

confidence: 99%

“…However, these methods have a common drawback, i.e., large-sized converted images. For example, many methods (e.g., [5][6][7][8]) convert the payloads of the first few packets of a flow into an image. They connect the payloads of the first few packets of a flow into a byte stream, and then convert a byte into an integer (0 to 255).…”

Section: Introductionmentioning

confidence: 99%

A Novel Lightweight Anonymous Proxy Traffic Detection Method Based on Spatio-Temporal Features

2022

Sensors

View full text Add to dashboard Cite

Anonymous proxies are used by criminals for illegal network activities due to their anonymity, such as data theft and cyber attacks. Therefore, anonymous proxy traffic detection is very essential for network security. In recent years, detection based on deep learning has become a hot research topic, since deep learning can automatically extract and select traffic features. To make (heterogeneous) network traffic adapt to the homogeneous input of typical deep learning algorithms, a major branch of existing studies convert network traffic into images for detection. However, such studies are commonly subject to the limitation of large-sized image representation of network traffic, resulting in very large storage and computational resource overhead. To address this limitation, a novel method for anonymous proxy traffic detection is proposed. The method is one of the solutions to reduce storage and computational resource overhead. Specifically, it converts the sequences of the size and inter-arrival time of the first N packets of a flow into images, and then categorizes the converted images using the one-dimensional convolutional neural network. Both proprietary and public datasets are used to validate the proposed method. The experimental results show that the converted images of the method are at least 90% smaller than that of existing image-based deep learning methods. With substantially smaller image sizes, the method can still achieve F1 scores up to 98.51% in Shadowsocks traffic detection and 99.8% in VPN traffic detection.

show abstract

When Network and Security Management Meets AI and Machine Learning

2022

AI and Machine Learning for Network and Security Management

View full text Add to dashboard Cite

MATEC: A lightweight neural network for online encrypted traffic classification

Cited by 46 publications

References 23 publications

Is Encrypted ClientHello a Challenge for Traffic Classification?

Is Encrypted ClientHello a Challenge for Traffic Classification?

A Novel Lightweight Anonymous Proxy Traffic Detection Method Based on Spatio-Temporal Features

When Network and Security Management Meets AI and Machine Learning

Contact Info

Product

Resources

About