Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

DRnet: Dynamic Retraining for Malicious Traffic Small-Sample Incremental Learning

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

A lightweight model design approach for few-shot malicious traffic classification

Adaptive and Lightweight Intrusive Traffic Detection Method Based on Deep Learning under Evolving Network Threats

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

Incremental Learning for Mobile Encrypted Traffic Classification

Using Incremental Learning Method for Adaptive Network Intrusion Detection

An Adaptive Enhancement Method of Malicious Traffic Samples Based on DCGAN-ResNet System

An Online Network Traffic Classification Method Based on Deep Learning

Incremental Learning for Malware Classification in Small Datasets.

Malware Traffic Classification Using Domain Adaptation and Ladder Network for Secure Industrial Internet of Things

FewFine: Few-shot Malware Traffic Classification Via Transfer Learning Based on Fine-tuning Strategy.

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

Incremental Learning Via Rate Reduction

Wireless Network Abnormal Traffic Detection Method Based on Deep Transfer Reinforcement Learning

Unbalanced Abnormal Traffic Detection Based on Improved Res-BIGRU and Integrated Dynamic ELM Optimization

A semi-supervised network traffic classification method based on incremental learning

Self-Supervised Learning Malware Traffic Classification Based On Masked Auto-Encoder

Network Abnormal Traffic Detection Framework Based on Deep Reinforcement Learning

Evading Machine Learning Botnet Detection Models via Deep Reinforcement Learning

EMTD-SSC: an Enhanced Malicious Traffic Detection Model Using Transfer Learning under Small Sample Conditions in IoT