Multi-Level P2P Traffic Classification Using Heuristic and Statistical-Based Techniques: A Hybrid Approach

Bhatia, Max; Sharma, Vikrant; Singh, Parminder; Masud, Mehedi

doi:10.3390/sym12122117

Cited by 46 publications

(3 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cao et al [25] developed an improved network traffic classification model based on SVM, achieving higher classification accuracy, 97.20%. Bhatia et al [26] proposed a DT-based multi-level P2P traffic classification technique based on packet and flow characteristics, achieving a combined accuracy rate of 98.30%. Dey et al [27] compared the performance of several ML models, including DT, RF, and artificial neural networks (ANNs), to classify network traffic and found that DT, RF, and ANNs achieved the best accuracy.…”

Section: Ml-based Network Traffic Classificationmentioning

confidence: 99%

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

Adeke,

Liu,

Zhao

et al. 2023

Future Internet

View full text Add to dashboard Cite

Machine learning (ML) models are essential to securing communication networks. However, these models are vulnerable to adversarial examples (AEs), in which malicious inputs are modified by adversaries to produce the desired output. Adversarial training is an effective defense method against such attacks but relies on access to a substantial number of AEs, a prerequisite that entails significant computational resources and the inherent limitation of poor performance on clean data. To address these problems, this study proposes a novel approach to improve the robustness of ML-based network traffic classification models by integrating derived variables (DVars) into training. Unlike adversarial training, our approach focuses on enhancing training using DVars, introducing randomness into the input data. DVars are generated from the baseline dataset and significantly improve the resilience of the model to AEs. To evaluate the effectiveness of DVars, experiments were conducted using the CSE-CIC-IDS2018 dataset and three state-of-the-art ML-based models: decision tree (DT), random forest (RF), and k-neighbors (KNN). The results show that DVars can improve the accuracy of KNN under attack from 0.45% to 0.84% for low-intensity attacks and from 0.32% to 0.66% for high-intensity attacks. Furthermore, both DT and RF achieve a significant increase in accuracy when subjected to attack of different intensity. Moreover, DVars are computationally efficient, scalable, and do not require access to AEs.

show abstract

Section: Ml-based Network Traffic Classificationmentioning

confidence: 99%

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

Adeke,

Liu,

Zhao

et al. 2023

Future Internet

View full text Add to dashboard Cite

show abstract

“…On the same dataset over VPN tunnels, they achieved a recall of about 88% using the C4.5 algorithm. The literature [18] proposed a multi-level P2P traffic classification technique using C4.5 decision trees and statistical features of flows for P2P classification, which was also applicable to encrypted traffic. Similarly, there is literature [19,20] that used machine learning (KNN, SVM) for fine-grained classification of encrypted traffic classification.…”

Section: Related Workmentioning

confidence: 99%

ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

Luktarhan

Ding

et al. 2021

Symmetry

View full text Add to dashboard Cite

The wide application of encryption technology has made traffic classification gradually become a major challenge in the field of network security. Traditional methods such as machine learning, which rely heavily on feature engineering and others, can no longer fully meet the needs of encrypted traffic classification. Therefore, we propose an Inception-LSTM(ICLSTM) traffic classification method in this paper to achieve encrypted traffic service identification. This method converts traffic data into common gray images, and then uses the constructed ICLSTM neural network to extract key features and perform effective traffic classification. To alleviate the problem of category imbalance, different weight parameters are set for each category separately in the training phase to make it more symmetrical for different categories of encrypted traffic, and the identification effect is more balanced and reasonable. The method is validated on the public ISCX 2016 dataset, and the results of five classification experiments show that the accuracy of the method exceeds 98% for both regular encrypted traffic service identification and VPN encrypted traffic service identification. At the same time, this deep learning-based classification method also greatly simplifies the difficulty of traffic feature extraction work.

show abstract

“…Encrypted traffic identification task [11], whose purpose is to classify traffic into encrypted and non-encrypted traffic; • Service identification task, whose aim is to identify the service type of various applications to which the traffic belongs, such as chat applications, file transfer applications, etc. ; • Traffic application identification task [9,12], whose aim is to identify the concrete applications to which the traffic belongs, such as Youtube, Gmail, etc. ;…”

mentioning

confidence: 99%

BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN

et al. 2023

View full text Add to dashboard Cite

With the speedy advancement of encryption technology and the exponential increase in applications, network traffic classification has become an increasingly important research topic. Existing methods for classifying encrypted traffic have certain limitations. For example, traditional approaches such as machine learning rely heavily on feature engineering, deep learning approaches are susceptible to the amount and distribution of labeled data, and pretrained models focus merely on the global traffic features while ignoring local features. To solve the above problem, we propose a BERT-based byte-level feature convolutional network (BFCN) model consisting of two novel modules. The first is a packet encoder module, in which we use the BERT pretrained encrypted traffic classification model to capture global traffic features through its attention mechanism; the second is a CNN module, which captures byte-level local features in the traffic through convolutional operations. The packet-level and byte-level features are concatenated as the traffic’s final representation, which can better represent encrypted traffic. Our approach achieves state-of-the-art performance on the publicly available ISCX-VPN dataset for the traffic service and application identification task, achieving F1 scores of 99.11% and 99.41%, respectively, on these two tasks. The experimental results demonstrate that our method further improves the performance of encrypted traffic classification.

show abstract

Multi-Level P2P Traffic Classification Using Heuristic and Statistical-Based Techniques: A Hybrid Approach

Cited by 46 publications

References 54 publications

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN

Contact Info

Product

Resources

About