Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

Application of Deep Recurrent Neural Networks for Prediction of User Behavior in Tor Networks

RNN-LSTM Based Deep Learning Model for Tor Traffic Classification

DeepOffense: a Recurrent Network Based Approach for Crime Prediction

Deep Learning Algorithm for Threat Detection in Hackers Forum (Deep Web)

Network Traffic Anomaly Detection Using Recurrent Neural Networks

A Kind of Prediction Method of User Behaviour for Future Trustworthy Network

Campus Network Traffic Prediction and Anomaly Detection Based on Deep Learning

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

Prediction of Future Terrorist Activities Using Deep Neural Networks

Temporal Sequence of Data Fluctuation-Based Approach for Tor Program Classification

Deep-Net: Deep Neural Network for Cyber Security Use Cases

A SURVEY ON DEEP LEARNING TECHNIQUES FOR DARKNET TRAFFIC MALWARE DETECTION

App Trajectory Recognition over Encrypted Internet Traffic Based on Deep Neural Network.

Neural-FacTOR: Neural Representation Learning for Website Fingerprinting Attack over TOR Anonymity

An efficient deep recurrent neural network for detection of cyberattacks in realistic IoT environment

Automated Website Fingerprinting through Deep Learning

Interpretable Nonroutine Network Traffic Prediction with a Case Study

A Novel Constructive Unceasement Conditional Random Field and Dynamic Bayesian Network Model for Attack Prediction on Internet of Vehicle

p-FP: Extraction, Classification, and Prediction of Website Fingerprints with Deep Learning

DeepBot: a Time-Based Botnet Detection with Deep Learning