App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification

Wang, Xin; Chen, Shuhui; Su, Jinshu

doi:10.1109/infocomwkshps50562.2020.9162891

Cited by 31 publications

(10 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the popularization and development of mobile networks, the classification of mobile traffic has also attracted the attention of many researchers [26,[35][36][37][38][39][40]. In 2019, Aceto et al [36] first proposed a deep learning-based mobile traffic classifier, which can deal with encrypted traffic and reflect its complex traffic patterns.…”

Section: Deep Learning Modelmentioning

confidence: 99%

See 1 more Smart Citation

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Wei

2021

Security and Communication Networks

View full text Add to dashboard Cite

The development of the Internet has led to the complexity of network encrypted traffic. Identifying the specific classes of network encryption traffic is an important part of maintaining information security. The traditional traffic classification based on machine learning largely requires expert experience. As an end-to-end model, deep neural networks can minimize human intervention. This paper proposes the CLD-Net model, which can effectively distinguish network encrypted traffic. By segmenting and recombining the packet payload of the raw flow, it can automatically extract the features related to the packet payload, and by changing the expression of the packet interval, it integrates the packet interval information into the model. We use the ability of Convolutional Neural Network (CNN) to distinguish image classes, learn and classify the grayscale images that the raw flow has been preprocessed into, and then use the effectiveness of Long Short-Term Memory (LSTM) network on time series data to further enhance the model’s ability to classify. Finally, through feature reduction, the high-dimensional features learned by the neural network are converted into 8 dimensions to distinguish 8 different classes of network encrypted traffic. In order to verify the effectiveness of the CLD-Net model, we use the ISCX public dataset to conduct experiments. The results show that our proposed model can distinguish whether the unknown network traffic uses Virtual Private Network (VPN) with an accuracy of 98% and can accurately identify the specific traffic (chats, audio, or file) of Facebook and Skype applications with an accuracy of 92.89%.

show abstract

Section: Deep Learning Modelmentioning

confidence: 99%

“…Finally, the class predicted by the model is obtained. In 2020, Wang et al [39,40] proposed a hybrid neural network model App-Net for mobile applications (APP) traffic identification, which can learn effective features from the original TLS flows. It achieves very good performance on real datasets covering 80 applications.…”

Section: Deep Learning Modelmentioning

confidence: 99%

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Wei

2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Network state detection can be considered a subset of the more general traffic classification field. To this end, ML-based traffic classification has been applied extensively against cyber attacks by diagnosing malicious traffic [10]- [14] and classifying encrypted traffic [15]- [19]. ML algorithms have also been used for comprehending the traffic flow [20], providing application-aware traffic classification [21], and classifying the network traffic via semi-supervised learning [15] or supervised learning [22] methods.…”

Section: Related Workmentioning

confidence: 99%

Machine Learning-Based Network Status Detection and Fault Localization

Mohammed

Côté

et al. 2021

IEEE Trans. Instrum. Meas.

View full text Add to dashboard Cite

Although the autonomous detection of network status and localization of network faults can be a valuable tool for network and service operators, very few works have investigated this subject. As a result in today's networks, fault detection and localization remains a mostly-manual process. In this paper, we propose a Machine Learning (ML) method that can automatically detect the status of a network and localize faults. Our method uses Decision Tree, Gradient Boosting (GB), and XGBoost (XGB) ML algorithms to detect the network status as Normal, Congestion, and Network Fault. In comparison, existing related work can at best classify the network status as faulty or non-faulty. Experimental results show that our method yields accuracies of up to 99% on a dataset collected through an emulated network.

show abstract

“…Then, the individual optimal solution and global optimal solution of each particle are initialized. Then, the algorithm updates the position and velocity of the particle, according to the velocity formula, as in (5), and the position formula, as in (6), where r 1 and r 2 are random numbers, w represents the internal factor, c 1 represents the local velocity factor, c 2 represents the global velocity factor, pbest represents the individual optimal solution, and gbest represents the global optimal solution. After the velocity and position of the particles are updated, the particle fitness is recalculated, and the individual optimal solution pbest and the global optimal solution gbest are updated, according to the fitness.…”

Section: Mopsomentioning

confidence: 99%

“…In the field of network intrusion detection, numerous scholars have extensively explored the network model of malicious network traffic classification and achieved excellent results. These studies often focused on feature selection [4], training strategy [5], model stacking [6] and other aspects, but there were few studies on the topological structure of classification models. A network that can solve complex problems often also has a complex structure, such as AlexNet [7], InceptionNet [8], MobileNet [9] and other architectures that were carefully designed by researchers in the field of image recognition.…”

Section: Introductionmentioning

confidence: 99%

Network Intrusion Detection Based on an Efficient Neural Architecture Search

Lyu¹,

He²,

Jin³

et al. 2021

Symmetry

View full text Add to dashboard Cite

Deep learning has been applied in the field of network intrusion detection and has yielded good results. In malicious network traffic classification tasks, many studies have achieved good performance with respect to the accuracy and recall rate of classification through self-designed models. In deep learning, the design of the model architecture greatly influences the results. However, the design of the network model architecture usually requires substantial professional knowledge. At present, the focus of research in the field of traffic monitoring is often directed elsewhere. Therefore, in the classification task of the network intrusion detection field, there is much room for improvement in the design and optimization of the model architecture. A neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal. For this reason, we propose a model that can perform NAS in the field of network traffic classification and search for the optimal architecture suitable for traffic detection based on the network traffic dataset. Each layer of our depth model is constructed according to the principle of maximum coding rate attenuation, which has strong consistency and symmetry in structure. Compared with some manually designed network architectures, classification indicators, such as Top-1 accuracy and F1 score, are also greatly improved while ensuring the lightweight nature of the model. In addition, we introduce a surrogate model in the search task. Compared to using the traditional NAS model to search the network traffic classification model, our NAS model greatly improves the search efficiency under the premise of ensuring that the results are not substantially different. We also manually adjust some operations in the search space of the architecture search to find a set of model operations that are more suitable for traffic classification. Finally, we apply the searched model to other traffic datasets to verify the universality of the model. Compared with several common network models in the traffic field, the searched model (NAS-Net) performs better, and the classification effect is more accurate.

show abstract

App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification

Cited by 31 publications

References 19 publications

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Machine Learning-Based Network Status Detection and Fault Localization

Network Intrusion Detection Based on an Efficient Neural Architecture Search

Contact Info

Product

Resources

About