Encrypted traffic classification based on fusion of vision transformer and temporal features

doi:10.19682/j.cnki.1005-8885.2023.0002

中国邮电高校学报(英文) ›› 2023, Vol. 30 ›› Issue (2): 73-82.doi: 10.19682/j.cnki.1005-8885.2023.0002

Encrypted traffic classification based on fusion of vision transformer and temporal features

王岚婷¹,胡威²,刘建毅¹,庞进²,高雅婷²,薛婧瑶¹,张婕³

1. 北京邮电大学
2. 国家电网有限公司信息通信分公司
3. 国网山东省电力公司信息通信公司

收稿日期:2022-03-24 修回日期:2022-11-21 出版日期:2023-04-30 发布日期:2023-04-27
通讯作者: 刘建毅 E-mail:liujy@bupt.edu.cn
基金资助:
网络安全设备协同防御与联动处置技术研究

Encrypted traffic classification based on fusion of vision transformer and temporal features

Wang Lanting, Hu Wei, Liu Jianyi Pang Jin, Gao Yating, Xue Jingyao, Zhang Jie

Received:2022-03-24 Revised:2022-11-21 Online:2023-04-30 Published:2023-04-27

摘要/Abstract

摘要：

Aiming at the problem that the current encrypted traffic classification methods only use the single network framework such as CNN, RNN, and SAE, and only construct a shallow network to extract features, which leads to the low accuracy of encrypted traffic classification, we proposed an encrypted traffic classification framework based on the fusion of Vision Transformer and temporal features. The framework use BoTNet to extract spatial features and BiLSTM to extract temporal features, then use After the two sub-networks are parallelized, the framework uses the feature fusion method of early fusion to perform feature fusion after the two sub-networks parallelized, and finally identify encrypted traffic through the fused features. The experimental results show that the method in this paper can enhance the performance of encrypted traffic classification by fusing multi-dimensional features. The accuracy rate of VPN and non-VPN binary classification is as high as 99.9%, and the accuracy rate of fine-grained encrypted traffic twelve-classification can also reach more than 99%.

关键词:

encrypted traffic classification| vision transformer| temporal feature

Abstract:

Aiming at the problem that the current encrypted traffic classification methods only use the single network framework such as convolutional neural network (CNN), recurrent neural network (RNN), and stacked autoencoder (SAE), and only construct a shallow network to extract features, which leads to the low accuracy of encrypted traffic classification, an encrypted traffic classification framework based on the fusion of vision transformer and temporal features was proposed. Bottleneck transformer network (BoTNet) was used to extract spatial features and bi-directional long short-term memory (BiLSTM) was used to extract temporal features. After the two sub-networks are parallelized, the feature fusion method of early fusion was used in the framework to perform feature fusion. Finally, the encrypted traffic was identified through the fused features. The experimental results show that the BiLSTM and BoTNet fusion transformer (BTFT) model can enhance the performance of encrypted traffic classification by fusing multi-dimensional features. The accuracy rate of a virtual private network (VPN) and non-VPN binary classification is 99.9%, and the accuracy rate of fine-grained encrypted traffic twelve-classification can also reach 97%.

Key words: encrypted traffic classification| vision transformer| temporal feature

Wang Lanting, Hu Wei, Liu Jianyi Pang Jin, Gao Yating, Xue Jingyao, Zhang Jie.

Encrypted traffic classification based on fusion of vision transformer and temporal features

[J]. The Journal of China Universities of Posts and Telecommunications, 2023, 30(2): 73-82.

参考文献

[1] KORCZY'NSKI M, DUDA A. Markov chain fingerprinting to classify encrypted traffic. Proceedings of the 2014 IEEE Conference on Computer Communications (INFOCOM'14), 2014, Apr 27 - May 2, Toronto, Canada. Piscataway, NJ, USA: IEEE, 2014: 781 -789.

[2] LI C X, GUO Y, WANG X. Towards privacy-preserving dynamic deep packet inspection over outsourced middleboxes. High- Confidence Computing, 2022, 2(1): Article 100033.

[3] NING J T, POH G S, LOH J C, et al. PrivDPI: privacy- preserving encrypted traffic inspection with reusable obfuscated rules. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security ( CCS'19), 2019, Nov 11 - 15, London, UK. New York, NY, USA: ACM, 2019: 1657 -1670.

[4] SHEKHAWAT A S, DI TROIA F, STAMP M. Feature analysis of encrypted malicious traffic. Expert Systems with Applications, 2019, 125: 130 -141.

[5] WANG W, ZHU M, WANG J L, et al. End-to-end encrypted traffic classification with one-dimensional convolution neural networks. Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI'17), 2017, Jul 22 - 24, Beijing, China. Piscataway, NJ, USA: IEEE, 2017: 43 - 48.

[6] RIMMER V, PREUVENEERS D, JUAREZ M, et al. Automated website fingerprinting through deep learning. Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS'18 ), 2018, Feb 18 - 21, San Diego, CA, USA. Reston, VA, USA: The Internet Society, 2018: 1 -15.

[7] ZENG Y, GU H X, WEI W T, et al. Deep-full-range: a deep learning based network encrypted traffic classification and intrusion detection framework. IEEE Access, 2019, 7: 45182 -45190.

[8] BU Z Y, ZHOU B, CHENG P Y, et al. Encrypted network traffic classification using deep and parallel network-in-network models. IEEE Access, 2020, 8: 132950 -132959.

[9] LOTFOLLAHI M, SIAVOSHANI M J, ZADE R S H, et al. Deep packet: a novel approach for encrypted traffic classification using deep learning. Soft Computing, 2020, 24(3): 1999 -2012.

[10] LIN K D, XU X L, GAO H H. TSCRNN: a novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT. Computer Networks, 2021, 190: Article 107974.

[11] DRAPER-GIL G, LASHKARI A H, MAMUN M S I, et al. Characterization of encrypted and VPN traffic using time-related features. Proceedings of the 2nd International Conference on Information Systems Security and Privacy ( ICISSP'16), 2016, Feb 19 - 21, Rome, Italy. Berlin, Germany: Springer, 2016: 407 -414.

Encrypted traffic classification based on fusion of vision transformer and temporal features

Encrypted traffic classification based on fusion of vision transformer and temporal features

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 0

编辑推荐

Metrics

本文评价