Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

Deep Forest with LRRS Feature for Fine-grained Website Fingerprinting with Encrypted SSL/TLS

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic

Efficient Fine-Grained Website Fingerprinting Via Encrypted Traffic Analysis with Deep Learning

Deep-Forest-Based Encrypted Malicious Traffic Detection

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

I $^{2}$ RNN: an Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

p-FP: Extraction, Classification, and Prediction of Website Fingerprints with Deep Learning

Website Fingerprinting And Identification Using Ordered Feature Sequences

DFLNet: Deep Federated Learning Network with Privacy Preserving for Vehicular LoRa Nodes Fingerprinting

Resource Knowledge-Driven Heterogeneous Graph Learning for Website Fingerprinting

Automated Website Fingerprinting through Deep Learning

Seamless Website Fingerprinting in Multiple Environments

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

Classifying encrypted traffic using adaptive fingerprints with multi-level attributes

Encrypted Malicious Traffic Detection Based on Ensemble Learning

Robust and Reliable Early-Stage Website Fingerprinting Attacks via Spatial-Temporal Distribution Analysis

Towards Fine-Grained Webpage Fingerprinting at Scale

DFFNet: Deep Federated Radio Fingerprinting Based on Fractional Wavelet Scattering Network.

From Traces to Packets: Realistic Deep Learning Based Multi-Tab Website Fingerprinting Attacks

A Fingerprint Enhancement and Second-Order Markov Chain Based Malicious Encrypted Traffic Identification Scheme