Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

A study on the application of the T5 large language model in encrypted traffic classification

EETC: an Extended Encrypted Traffic Classification Algorithm Based on Variant Resnet Network

An encrypted traffic identification method based on multi-scale feature fusion

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

Encrypted Traffic Classification Based on Traffic Reconstruction

TPIPD: A Robust Model for Online VPN Traffic Classification.

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

ILETC: Incremental learning for encrypted traffic classification using generative replay and exemplar

LAMBERT: Leveraging Attention Mechanisms to Improve the BERT Fine-Tuning Model for Encrypted Traffic Classification

Image-based Encrypted Traffic Classification with Convolution Neural Networks

Deep learning-based real-time VPN encrypted traffic identification methods

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

Real-time Traffic Classification for 5G NSA Encrypted Data Flows With Physical Channel Records

End-to-end encrypted traffic classification with one-dimensional convolution neural networks

A Deep Learning-Based Encrypted VPN Traffic Classification Method Using Packet Block Image

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Streaming traffic classification: a hybrid deep learning and big data approach

BFSN: A Novel Method of Encrypted Traffic Classification Based on Bidirectional Flow Sequence Network

PacketCGAN: Exploratory Study of Class Imbalance for Encrypted Traffic Classification Using CGAN