Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

Temporal Sequence of Data Fluctuation-Based Approach for Tor Program Classification

QTFN: A General End-to-End Time-Frequency Network to Reveal the Time-Varying Signatures of the Time Series

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

A Hierarchical Classification Approach for Tor Anonymous Traffic

TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT

Encrypted Malicious Traffic Detection Based on Ensemble Learning

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

BFSN: A Novel Method of Encrypted Traffic Classification Based on Bidirectional Flow Sequence Network

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

MT-FlowFormer: A Semi-Supervised Flow Transformer for Encrypted Traffic Classification

RNN-LSTM Based Deep Learning Model for Tor Traffic Classification

Classifying Tor Traffic Encrypted Payload Using Machine Learning

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

I $^{2}$ RNN: an Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

An Encrypted Malicious Traffic Detection System Based on Neural Network

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

Obfuscated Tor Traffic Identification Based on Sliding Window.

TGA: A Novel Network Intrusion Detection Method Based on TCN, BiGRU and Attention Mechanism

TSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.