CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Abstract

With the rapid increase in encrypted traffic in the network environment and the increasing proportion of encrypted traffic, the study of encrypted traffic classification has become increasingly important as a part of traffic analysis. At present, in a closed environment, the classification of encrypted traffic has been fully studied, but these classification models are often only for labeled data and difficult to apply in real environments. To solve these problems, we propose a transferable model called CBD with generalization abilities for encrypted traffic classification in real environments. The overall structure of CBD can be generally described as a of one-dimension CNN and the encoder of Transformer. The model can be pre-trained with unlabeled data to understand the basic characteristics of encrypted traffic data, and be transferred to other datasets to complete the classification of encrypted traffic from the packet level and the flow level. The performance of the proposed model was evaluated on a public dataset. The results showed that the performance of the CBD model was better than the baseline methods, and the pre-training method can improve the classification ability of the model.

OpenCBD: A Network-Encrypted Unknown Traffic Identification Scheme Based on Open-Set Recognition

“…To identify unknown classes that have not appeared in the training set, we propose OpenCBD, a deep learning and ensemble learning-based approach. The CBD model was proposed in [12], but it can only complete the classification task in datasets with known class traffic. In this paper, the CBD model is regarded as an individual model.…”

“…Wireless Communications and Mobile Computing integration. Following the description in [12], we summarize the preprocessing process as Algorithm 1. Line 2 is the traffic split.…”

“…Pretraining adopts a common pretraining method in the field of encrypted traffic analysis proposed in [12], which starts from the packet level and the flow level, and can directly deepen the model's understanding of encrypted traffic from unlabeled real-world data. This paper summarizes the method into a detailed Algorithm 2.…”

“…This paper proposes an unknown traffic identification method OpenCBD based on open-set recognition. It first performs a pretraining process based on self-supervised learning on unlabeled data, so that the CBD model (CBD model was proposed in [12]; it is a self-supervised learning model containing three modules; the three modules are the CNN module-based on a convolutional neural network, BERT module-based on a transformer model encoder, dense module-based on a fully connected network) has a certain understanding of the basic characteristics of encrypted traffic. Then, the training and testing process based on ensemble learning is designed in the open set.…”

A New Imbalanced Encrypted Traffic Classification Model Based on CBAM and Re-Weighted Loss Function

“…ICLSTM [9] uses long short-term memory networks (LSTMs), and ETCC [10] uses convolutional neural networks (CNNs) to automatically extract representations from raw packet size sequences of the encrypted traffic. CBD [11] is pre-trained with unlabeled data to classify encrypted traffic from the packet level and traffic level. However, these approaches rely on a large amount of balanced data, while the vast majority of datasets cannot meet this requirement.…”