Abstract:Traffic characterization (e.g., chat, video) and application identification (e.g., FTP, Facebook) are two of the more crucial jobs in encrypted network traffic classification. These two activities are typically carried out separately by existing systems using separate models, significantly adding to the difficulty of network administration. Convolutional Neural Network (CNN) and Transformer are deep learning-based approaches for network traffic classification. CNN is good at extracting local features while ignoring long-distance information from the network traffic sequence, and Transformer can capture long-distance feature dependencies while ignoring local details. Based on these characteristics, a multi-task learning model that combines Transformer and 1D-CNN for encrypted traffic classification is proposed (MTC). In order to make up for the Transformer’s lack of local detail feature extraction capability and the 1D-CNN’s shortcoming of ignoring long-distance correlation information when processing traffic sequences, the model uses a parallel structure to fuse the features generated by the Transformer block and the 1D-CNN block with each other using a feature fusion block. This structure improved the representation of traffic features by both blocks and allows the model to perform well with both long and short length sequences. The model simultaneously handles multiple tasks, which lowers the cost of training. Experiments reveal that on the ISCX VPN-nonVPN dataset, the model achieves an average F1 score of 98.25% and an average recall of 98.30% for the task of identifying applications, and an average F1 score of 97.94%, and an average recall of 97.54% for the task of traffic characterization. When advanced models on the same dataset are chosen for comparison, the model produces the best results. To prove the generalization, we applied MTC to CICIDS2017 dataset, and our model also achieved good results.

TCMal: A Hybrid Deep Learning Model for Encrypted Malicious Traffic Classification

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

HALNet - A Hybrid Deep Learning Model for Encrypted C&C Malware Traffic Detection.

An Encrypted Malicious Traffic Detection System Based on Neural Network

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

HMMED: A Multimodal Model with Separate Head and Payload Processing for Malicious Encrypted Traffic Detection

MTC: A Multi-Task Model for Encrypted Network Traffic Classification Based on Transformer and 1D-CNN

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Self-Supervised Learning Malware Traffic Classification Based On Masked Auto-Encoder

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

A Survey of Encrypted Malicious Traffic Detection*

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

DeepMAL -- Deep Learning Models for Malware Traffic Detection and Classification

A Malicious Domain Detection Model Based on Improved Deep Learning

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Beyond known threats: A novel strategy for isolating and detecting unknown malicious traffic

Channel Features and API Frequency-Based Transformer Model for Malware Identification