Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

Cyberspace Attack Detection Based On Advanced Initialized Recurrent Neural Network

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

A DDOS Attack Detection Method Based on Recurrent Neural Network

Advancements in intrusion detection: A lightweight hybrid RNN-RF model

Network Traffic Anomaly Detection Using Recurrent Neural Networks

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

RNNSecureNet: Recurrent neural networks for Cyber security use-cases

Computer Network Intrusion Anomaly Detection with Recurrent Neural Network

ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena

Using a Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) to Classify Network Attacks

Anomaly-Based Web Attack Detection: A Deep Learning Approach

Anomaly-Based Web Attack Detection

RNNIDS: Enhancing Network Intrusion Detection Systems through Deep Learning

Network Anomaly Intrusion Detection Based on Deep Learning Approach

XGBoost Regression Classifier (XRC) Model for Cyber Attack Detection and Classification Using Inception V4

An Intrusion Detection Method Based on Fully Connected Recurrent Neural Network

An efficient deep recurrent neural network for detection of cyberattacks in realistic IoT environment

Defense-Resistant Backdoor Attacks Against Deep Neural Networks in Outsourced Cloud Environment

DDoSNet: A Deep-Learning Model for Detecting Network Attacks

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection