Abstract:Accurately classifying encrypted traffic is the indispensable cornerstone for network management and Quality of Service (QoS) improvement. Although existing works that learn from non-interaction features of communication behavior have achieved a satisfactory performance, there still remains an unsolved crux before practical application that current works fail to distinguish different encrypted traffic generated by the same application. Such similar but distinct traffic is widely-existed since applications typically employ similar communication settings and encryption technology for diverse data transmission. To address the above issues, this work proposes that interaction features of communication behavior provide substantial information in terms of traffic classification, while directly leveraging such diversiform interaction information is non-trivial. As a solution, we devise a novel graph structure preserving the information of interactive process, referred to interactive behavior graph, to represent communication behaviors. Specifically, the proposed interactive behavior graph respectively stores the transition status and interaction status of the interactive actions during the interactive process in the edges and vertices with attributes. In addition, a classification model is tailored based on sampling subgraphs, which capture communication behavior patterns from the strong interaction correlation among neighboring interactive actions. Comprehensive experimental results demonstrate the superiority of our method over solid comparisons. Particularly, in distinguishing similar encrypted traffic, our method achieves an accuracy rate exceeding 98%, which outperforms the state-of-the-art methods. Furthermore, we validate the generalizability of our proposed method on two well-known encrypted traffic datasets, attaining an accuracy rate of 94%.

A Survey on Encrypted Traffic Classification

Unidirectional Encrypted Traffic Classification: A Survey

A Survey on Encrypted Traffic Identification

Few-Shot Encrypted Traffic Classification: A Survey

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

Encrypted Traffic Classification Using Graph Convolutional Networks.

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

A Survey of Encrypted Malicious Traffic Detection*

Encrypted Traffic Classification Based on Traffic Reconstruction

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

End-to-end encrypted traffic classification with one-dimensional convolution neural networks

Machine Learning Classification on Traffic of Secondary Encryption

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

SSL/TLS Encrypted Traffic Application Layer Protocol and Service Classification

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

Classification of Encrypted Traffic with Second-Order Markov Chains and Application Attribute Bigrams.

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Interaction Matters: Encrypted Traffic Classification Via Status-Based Interactive Behavior Graph

Traffic Classification: Issues and Challenges

Review and Perspective on Encrypted Traffic Identification Research

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features