Abstract:Network traffic classification, which can map network traffic to protocols in the application layer, is a fundamental technique for network management and security issues such as Quality of Service, network measurement, and network monitoring. Recent researchers focus on extracting features for traditional machine learning methods from flows or datagrams of the specific protocol. However, as the rapid growth of network applications, previous works cannot handle complex novel protocols well. In this paper, we introduce the recurrent neural network to network traffic classification and design a novel neural network, the Byte Segment Neural Network (BSNN). BSNN treats network datagrams as input and gives the classification results directly. In BSNN, a datagram is firstly broken into serval byte segments. Then, these segments are fed to encoders which are based on the recurrent neural network. The information extracted by encoders is combined to a representation vector of the whole datagram. Finally, we apply the softmax function to use this vector for predicting the application protocol of this datagram. There are several key advantages of BSNN: 1) no need for prior knowledge of target applications; 2) can handle both connection-oriented protocols and connection-less protocols; 3) supports multi-classification for protocols; 4) shows outstanding accuracy in both traditional protocols and complex novel protocols. Our thorough experiments on real-world data with different protocols indicate that BSNN gains average F1-measure about 95.82% in multi-classification for five protocols including QQ, PPLive, DNS, 360 and BitTorrent. And it also shows excellent performance for detection of novel protocols. Furthermore, compared with two recent state-of-the-art works, BSNN has superiority over the traditional machine learning-based method and the packet inspection method.

Network Traffic Classification Method Supporting Unknown Protocol Detection

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Classification and Recognition of Unknown Network Protocol Characteristics.

Traffic Classification - Towards Accurate Real Time Network Applications

Hybrid Internet Traffic Classification Technique

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Application traffic classification based on command exchange mode of TCP flows

Network Traffic Classification Algorithm Based on Spectral Clustering

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

Composite Lightweight Traffic Classification System for Network Management

Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

Byte Segment Neural Network for Network Traffic Classification

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Novel Dynamic Multiple Classification System for Network Traffic

CM-UTC: A Cost-sensitive Matrix based Method for Unknown Encrypted Traffic Classification

A Deep Learning-Based Encrypted VPN Traffic Classification Method Using Packet Block Image

OpenCBD: A Network-Encrypted Unknown Traffic Identification Scheme Based on Open-Set Recognition

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

A Self-Supervised Learning Model for Unknown Internet Traffic Identification Based on Surge Period

A New Network Traffic Classification Method Based on Classifier Integration

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics