scholarly journals ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

Symmetry ◽  
2021 ◽  
Vol 13 (6) ◽  
pp. 1080
Author(s):  
Bei Lu ◽  
Nurbol Luktarhan ◽  
Chao Ding ◽  
Wenhui Zhang

The wide application of encryption technology has made traffic classification gradually become a major challenge in the field of network security. Traditional methods such as machine learning, which rely heavily on feature engineering and others, can no longer fully meet the needs of encrypted traffic classification. Therefore, we propose an Inception-LSTM(ICLSTM) traffic classification method in this paper to achieve encrypted traffic service identification. This method converts traffic data into common gray images, and then uses the constructed ICLSTM neural network to extract key features and perform effective traffic classification. To alleviate the problem of category imbalance, different weight parameters are set for each category separately in the training phase to make it more symmetrical for different categories of encrypted traffic, and the identification effect is more balanced and reasonable. The method is validated on the public ISCX 2016 dataset, and the results of five classification experiments show that the accuracy of the method exceeds 98% for both regular encrypted traffic service identification and VPN encrypted traffic service identification. At the same time, this deep learning-based classification method also greatly simplifies the difficulty of traffic feature extraction work.

2021 ◽  
Vol 15 ◽  
Author(s):  
Mengmeng Ge ◽  
Xiangzhan Yu ◽  
Likun Liu

With the rapid popularization of robots, the risks brought by robot communication have also attracted the attention of researchers. Because current traffic classification methods based on plaintext cannot classify encrypted traffic, other methods based on statistical analysis require manual extraction of features. This paper proposes (i) a traffic classification framework based on a capsule neural network. This method has a multilayer neural network that can automatically learn the characteristics of the data stream. It uses capsule vectors instead of a single scalar input to effectively classify encrypted network traffic. (ii) For different network structures, a classification network structure combining convolution neural network and long short-term memory network is proposed. This structure has the characteristics of learning network traffic time and space characteristics. Experimental results show that the network model can classify encrypted traffic and does not require manual feature extraction. And on the basis of the previous tool, the recognition accuracy rate has increased by 8%


2014 ◽  
Vol 989-994 ◽  
pp. 1895-1900
Author(s):  
Hong Zhi Wang ◽  
Li Hui Yan

The traditional network traffic classification methods have many shortcomings, the classification accuracy is not high, the encrypted traffic cannot be analyzed, and the computational burden is usually large. To overcome above problems, this paper presents a new network traffic classification method based on optimized Hadamard matrix and ECOC. Through restructuring the Hadamard matrix and erasing the interference rows and columns, the ECOC table is optimized while eliminating SVM sample imbalance, and the error correcting ability for classification is reserved. The experiments results show that the proposed method outperform in network traffic classification and improve the classification accuracy.


2021 ◽  
pp. 108472
Author(s):  
Jin Cheng ◽  
Yulei Wu ◽  
Yuepeng E ◽  
Junling You ◽  
Tong Li ◽  
...  

Sensors ◽  
2021 ◽  
Vol 21 (24) ◽  
pp. 8231
Author(s):  
Xinyi Hu ◽  
Chunxiang Gu ◽  
Yihang Chen ◽  
Fushan Wei

With the rapid increase in encrypted traffic in the network environment and the increasing proportion of encrypted traffic, the study of encrypted traffic classification has become increasingly important as a part of traffic analysis. At present, in a closed environment, the classification of encrypted traffic has been fully studied, but these classification models are often only for labeled data and difficult to apply in real environments. To solve these problems, we propose a transferable model called CBD with generalization abilities for encrypted traffic classification in real environments. The overall structure of CBD can be generally described as a of one-dimension CNN and the encoder of Transformer. The model can be pre-trained with unlabeled data to understand the basic characteristics of encrypted traffic data, and be transferred to other datasets to complete the classification of encrypted traffic from the packet level and the flow level. The performance of the proposed model was evaluated on a public dataset. The results showed that the performance of the CBD model was better than the baseline methods, and the pre-training method can improve the classification ability of the model.


Sign in / Sign up

Export Citation Format

Share Document