Payload-Based Network Traffic Analysis for Application Classification and Intrusion Detection

Ozdel, Suleyman; Ates, Cagatay; Ates, Pelin Damla; Koca, Mutlu; Anarım, Emin

doi:10.23919/eusipco55093.2022.9909683

Cited by 5 publications

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traffic classification based on payload involves delving into the content of packets by examining the entire packet content [19], including headers and payloads, to identify specific strings or string patterns predefined within the packets. Unlike port-based methods, payload-based methods analyze particular data generated by network services or applications that remain unaltered.…”

Section: Network Traffic Classification Methodsmentioning

confidence: 99%

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Wang,

Zhang,

Hao

et al. 2024

Electronics

View full text Add to dashboard Cite

The demand for encrypted communication is increasing with the continuous development of secure and trustworthy networks. In edge computing scenarios, the requirement for data processing security is becoming increasingly high. Therefore, the accurate identification of encrypted traffic has become a prerequisite to ensure edge intelligent device security. Currently, encrypted network traffic classification relies on single-feature extraction methods. These methods have simple feature extraction, making distinguishing encrypted network data flows and designing compelling manual features challenging. This leads to low accuracy in multi-classification tasks involving encrypted network traffic. This paper proposes a hybrid deep learning model for multi-classification tasks to address this issue based on the synergy of dilated convolution and gating unit mechanisms. The model comprises a Gated Dilated Convolution (GDC) module and a CA-LSTM module. The GDC module completes the spatial feature extraction of encrypted network traffic through dilated convolution and gating unit mechanisms. In contrast, the CA-LSTM module focuses on extracting temporal network traffic features. By employing a collaborative approach to extract spatio-temporal features, the model ensures feature extraction diversity, guarantees robustness, and effectively enhances the feature extraction rate. We evaluate our multi-classification model using the ISCX VPN-nonVPN public dataset. Experimental results show that the proposed method achieves an accuracy rate of over 95% and a recall rate of over 90%, significantly outperforming existing methods.

show abstract

Section: Network Traffic Classification Methodsmentioning

confidence: 99%

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Wang,

Zhang,

Hao

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

“…Payload-based network traffic classification technology is a method that directly examines the packets of network traffic to differentiate traffic, a method that verifies the actual network traffic [27]. Network traffic includes the sending packet's IP, the receiving packet's IP, the type of protocol, the used port number, etc., and it classifies using the payload, which represents the actual content of the packet.…”

Section: Payload-based Network Traffic Classification In Cyber Trainingmentioning

confidence: 99%

An Investigation of Learning Model Technologies for Network Traffic Classification Design in Cyber Security Exercises

Jang,

Kim,

Shin

et al. 2023

IEEE Access

View full text Add to dashboard Cite

With the proliferation of network systems, the boundaries between cyber and physical environments are blurring, leading to an increased risk of sophisticated cyber-attacks equipped with advanced technologies. In particular, as advancements in artificial intelligence through learning models have led to automated attacks and attack scenarios, countries are implementing cyber training and constructing training systems to respond to cyber security threats. This cyber training is based on existing cyber-attacks and conducted in virtual spaces similar to reality, generating network traffic through simulators and focusing on training for attack response and cyber resilience. However, the exponential increase in the number of networkbased devices and the amount of network traffic they generate is leading to a gradual increase in threats to cyber security. In this study, we first investigated the existing port number-based network traffic classification technologies and payload-based network traffic classification technologies to identify their shortcomings in the current network environment. We then categorized existing studies into supervised, unsupervised, and reinforcement learning to analyze the technology of classifying network traffic based on learning models as well as classification methods, procedures, performance standards, evaluation methods, quality of service/quality of experience, etc. Based on the analysis, we presented limitations for application to training networks according to the learning method and suggested recommendations for establishing future research directions. Therefore, refining learning model-based network traffic classification technology will contribute to the construction of automated cyber training grounds such as cyber-attack-defense scenarios, network traffic anomaly detection, and maximizing cumulative rewards.

show abstract

A Deep Intrusion Detection Model for Network Traffic Payload Analysis

Hojjatinia,

Monshizadeh,

Khatri

2023

2023 International Conference on Software, Telecommunications and Computer Networks (SoftCOM)

View full text Add to dashboard Cite

Payload-Based Network Traffic Analysis for Application Classification and Intrusion Detection

Cited by 5 publications

References 10 publications

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

An Investigation of Learning Model Technologies for Network Traffic Classification Design in Cyber Security Exercises

A Deep Intrusion Detection Model for Network Traffic Payload Analysis

Contact Info

Product

Resources

About