Content Recognition of Network Traffic Using Wavelet Transform and CNN

Liang, Yu; Xie, Yi; Fei, Xingrui; Tan, Xincheng; Ma, Haiying

doi:10.1007/978-3-030-30619-9_16

Cited by 3 publications

(4 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some examples of features constructed from observable metadata include features based on simple statistics derived from flows [9], [28], [31], [34]- [43] and wavelet-based features [10], [44]. While traffic classification methods that use flow statistic-based features yield respectable results for isolated application classification in contained environments, it is uncertain whether they are robust enough to be utilized in realworld settings.…”

Section: B Encrypted Traffic Classificationmentioning

confidence: 99%

“…Shi et al [44] are the first to use wavelet-based features for traffic classification and show that SVMs trained with wavelet features outperform those trained with flow statistic-based features. Later [10] used Convolutional Neural Networks (CNNs) trained on waveletbased features for traffic classification. We build on this approach by dividing the connections into chunks of time rather than classifying the aggregate connection all at once and combining flow statistic-based features and wavelet features in each time window.…”

Section: B Encrypted Traffic Classificationmentioning

confidence: 99%

“…Existing work in machine learning for encrypted traffic classification has focused primarily on feature construction and model development to optimize raw performance metrics such as overall accuracy. For example, traditional machine learning models (like naïve Bayes and decision trees) have been applied to simple statistical features [8], [9] and neural networks based on one or two-dimensional convolutions have been applied to sequences of raw byte values, interarrival times, and wavelet coefficients [10]- [16]. Many of these techniques yield very good performance on publicly available data, the most popular being the ISCXVPN2016 dataset [9].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification

Jorgensen¹,

Holodnak²,

Dempsey³

et al. 2022

Preprint

View full text Add to dashboard Cite

With the increasing prevalence of encrypted network traffic, cyber security analysts have been turning to machine learning (ML) techniques to elucidate the traffic on their networks. However, ML models can become stale as known traffic features can shift between networks and as new traffic emerges that is outside of the distribution of the training set. In order to reliably adapt in this dynamic environment, ML models must additionally provide contextualized uncertainty quantification to their predictions, which has received little attention in the cyber security domain. Uncertainty quantification is necessary both to signal when the model is uncertain about which class to choose in its label assignment and when the traffic is not likely to belong to any pre-trained classes.We present a new, public dataset of network traffic that includes labeled, Virtual Private Network (VPN)-encrypted network traffic generated by 10 applications and corresponding to 5 application categories. We also present an ML framework that is designed to rapidly train with modest data requirements and provide both calibrated, predictive probabilities as well as an interpretable "out-of-distribution" (OOD) score to flag novel traffic samples. We describe how to compute a calibrated OOD score from p-values of the so-called relative Mahalanobis distance.We demonstrate that our framework achieves an F1 score of 0.98 on our dataset and that it can extend to an enterprise network by testing the model: (1) on data from similar applications, (2) on dissimilar application traffic from an existing category, and (3) on application traffic from a new category. The model correctly flags uncertain traffic and, upon retraining, accurately incorporates the new data. We additionally demonstrate good performance (F1 score of 0.97) when packet sizes are made to be uniform, as occurs for certain encryption protocols.

show abstract

Section: B Encrypted Traffic Classificationmentioning

confidence: 99%

Section: B Encrypted Traffic Classificationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification

Jorgensen¹,

Holodnak²,

Dempsey³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Wavelets are also widely used in computer science, such as for Internet traffic description, speech recognition, computer graphic and multifractal analysis, etc. Liang et al [13] combined wavelet transform and a convolutional neural network for content recognition of Internet traffic. Wavelet is also used to denoise speech during speech recognition [14].…”

Section: Introductionmentioning

confidence: 99%

A Novel Wavelet Selection Method for Seismic Signal Intelligent Processing

Wang

Peng

2022

Applied Sciences

View full text Add to dashboard Cite

Wavelet transform is a widespread and effective method in seismic waveform analysis and processing. Choosing a suitable wavelet has also aroused many scholars’ research interest and produced many effective strategies. However, with the convenience of seismic data acquisition, the existing wavelet selection methods are unsuitable for the big dataset. Therefore, we proposed a novel wavelet selection method considering the big dataset for seismic signal intelligent processing. The relevance r is calculated using the seismic waveform’s correlation coefficient and variance contribution rate. Then values of r are calculated from all seismic signals in the dataset to form a set. Furthermore, with a mean value μ and variance value σ2 of that set, we define the decomposition stability w as μ/σ2. Then, the wavelet that maximizes w for this dataset is considered to be the optimal wavelet. We applied this method in automatic mining-induced seismic signal classification and automatic seismic P arrival picking. In classification experiments, the mean accuracy is 93.13% using the selected wavelet, 2.22% more accurate than other wavelets generated. Additionally, in the picking experiments, the mean picking error is 0.59 s using the selected wavelet, but is 0.71 s using others. Moreover, the wavelet packet decomposition level does not affect the selection of wavelets. These results indicate that our method can really enhance the intelligent processing of seismic signals.

show abstract