Attention-based bidirectional GRU networks for efficient HTTPS traffic classification

Liu, Xun; You, Jinmao; Wu, Yulei; Li, Tong; Li, Liangxiong; Zhang, Zheyuan; Ge, Jingguo

doi:10.1016/j.ins.2020.05.035

Cited by 74 publications

(20 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It allows AB-RF to achieve low training time and high prediction throughput. Simultaneously, AB-RF outperforms the best known from the literature classifiers, namely, BGRUA [10] and MATEC [11] in classification quality. • We introduce the recomposition algorithm for TLS Hello messages to place TLS parameters on the same positions for different handshakes.…”

Section: Introductionmentioning

confidence: 85%

“…Obviously, ECH prevents SNI-based classification. However, many studies show that Neural Network (NN) algorithms that analyze TLS handshake payload bytes provide QoS-aware classification even with hidden SNI [10], [11]. In Section III-D, we discuss them in more details.…”

Section: ) Qos Provisioningmentioning

confidence: 99%

“…The authors of [10] introduced a bidirectional gated recurrent unit (GRU) network with a self-attention mechanism (BGRUA). They chose GRU instead of LSTM as a recurrent unit because GRU has a less complex structure and it is more computationally efficient.…”

Section: State-of-the-art In Tls Payload-based Tcmentioning

confidence: 99%

See 2 more Smart Citations

Is Encrypted ClientHello a Challenge for Traffic Classification?

et al. 2022

View full text Add to dashboard Cite

Although the widely-used Transport Layer Security (TLS) protocol hides application data, an unencrypted part of the TLS handshake, specifically the server name indication (SNI), is a backdoor for encrypted traffic classification frameworks. The recently developed Encrypted ClientHello (ECH) amendment to the TLS protocol aims to protect the privacy-sensitive content of the ClientHello message, including SNI. Conversely, ECH can be a game-changer in the early detection of encrypted traffic. The paper shows that the performance of the state-of-the-art traffic classification algorithms degrades significantly with the introduction of the ECH. Hence, novel approaches to real-time traffic classification are required. The paper develops two novel traffic classification algorithms to address this challenge. The first one uses unencrypted bytes of the TLS Hello messages as independent features of the Random Forest algorithm. It is extremely lightweight and suits throughput-focused traffic classification. It is faster than state-of-the-art algorithms by three times and achieves higher classification quality. The second algorithm augments the approach of the first one by focusing on the particular metadata of the handshake. This way, it efficiently extracts data from the exchange and achieves the highest classification quality in all the considered scenarios. It has a three times lower error rate than state-of-the-art algorithms and provides a reliable classification of ECH traffic.

show abstract

Section: Introductionmentioning

confidence: 85%

Section: ) Qos Provisioningmentioning

confidence: 99%

See 1 more Smart Citation

Is Encrypted ClientHello a Challenge for Traffic Classification?

et al. 2022

View full text Add to dashboard Cite

show abstract

“…In 2020, Liu et al [13] proposed a model based on two-way gated recurrent unit and attention mechanism (BGRUA) to classify and identify Web services running on Hyper Text Transfer Protocol over SecureSocket Layer (HTTPS) connections. The two-way GRU can extract the forward and backward features of the byte sequence in the sessions, and the attention mechanism can assign weights to the features according to their contribution to the classification.…”

Section: Applications Of Transfer Learningmentioning

confidence: 99%

CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Chen³

et al. 2021

Sensors

View full text Add to dashboard Cite

With the rapid increase in encrypted traffic in the network environment and the increasing proportion of encrypted traffic, the study of encrypted traffic classification has become increasingly important as a part of traffic analysis. At present, in a closed environment, the classification of encrypted traffic has been fully studied, but these classification models are often only for labeled data and difficult to apply in real environments. To solve these problems, we propose a transferable model called CBD with generalization abilities for encrypted traffic classification in real environments. The overall structure of CBD can be generally described as a of one-dimension CNN and the encoder of Transformer. The model can be pre-trained with unlabeled data to understand the basic characteristics of encrypted traffic data, and be transferred to other datasets to complete the classification of encrypted traffic from the packet level and the flow level. The performance of the proposed model was evaluated on a public dataset. The results showed that the performance of the CBD model was better than the baseline methods, and the pre-training method can improve the classification ability of the model.

show abstract

“…It is applied to network traffic classification and has achieved satisfactory classification performance ( Pacheco et al, 2018 ; Liu et al, 2017 ). Liu et al (2020) proposed an HTTP traffic classification method based on the bidirectional Gated Recurrent Unit (GRU) Neural Network. This method utilized the bidirectional GRU to extract the forward and backward features of byte sequences in the session, and then employed the attention mechanism to assign the weight of the features according to their contributions.…”

Section: Introductionmentioning

confidence: 99%

An internet traffic classification method based on echo state network and improved salp swarm algorithm

Zhang

Sun

Tian

et al. 2022

PeerJ Computer Science

View full text Add to dashboard Cite

Internet traffic classification is fundamental to network monitoring, service quality and security. In this paper, we propose an internet traffic classification method based on the Echo State Network (ESN). To enhance the identification performance, we improve the Salp Swarm Algorithm (SSA) to optimize the ESN. At first, Tent mapping with reversal learning, polynomial operator and dynamic mutation strategy are introduced to improve the SSA, which enhances its optimization performance. Then, the advanced SSA are utilized to optimize the hyperparameters of the ESN, including the size of the reservoir, sparse degree, spectral radius and input scale. Finally, the optimized ESN is adopted to classify Internet traffic. The simulation results show that the proposed ESN-based method performs much better than other traditional machine learning algorithms in terms of per-class metrics and overall accuracy.

show abstract

Attention-based bidirectional GRU networks for efficient HTTPS traffic classification

Cited by 74 publications

References 36 publications

Is Encrypted ClientHello a Challenge for Traffic Classification?

Is Encrypted ClientHello a Challenge for Traffic Classification?

CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

An internet traffic classification method based on echo state network and improved salp swarm algorithm

Contact Info

Product

Resources

About