Data Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey

Krupski, Jacek; Graniszewski, Waldemar; Iwanowski, Marcin

doi:10.3390/electronics10162042

Cited by 21 publications

(6 citation statements)

References 120 publications

(268 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In teacher-less learning, data are unlabeled and patterns are sought during the learning process by clustering the data. Feedback learning works with an agent that replaces human operators and helps determine the outcome (build a model) based on feedback [9,41].…”

Section: Machine Learning Techniques For Traffic Classificationmentioning

confidence: 99%

See 1 more Smart Citation

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Holasova,

Fujdiak,

Misurec

2024

Algorithms

View full text Add to dashboard Cite

The interconnection of Operational Technology (OT) and Information Technology (IT) has created new opportunities for remote management, data storage in the cloud, real-time data transfer over long distances, or integration between different OT and IT networks. OT networks require increased attention due to the convergence of IT and OT, mainly due to the increased risk of cyber-attacks targeting these networks. This paper focuses on the analysis of different methods and data processing for protocol recognition and traffic classification in the context of OT specifics. Therefore, this paper summarizes the methods used to classify network traffic, analyzes the methods used to recognize and identify the protocol used in the industrial network, and describes machine learning methods to recognize industrial protocols. The output of this work is a comparative analysis of approaches specifically for protocol recognition and traffic classification in OT networks. In addition, publicly available datasets are compared in relation to their applicability for industrial protocol recognition. Research challenges are also identified, highlighting the lack of relevant datasets and defining directions for further research in the area of protocol recognition and classification in OT environments.

show abstract

Section: Machine Learning Techniques For Traffic Classificationmentioning

confidence: 99%

“…If a neural network has multiple layers, it is referred to as a Deep Neural Network (DNN). These algorithms include Convolutional Neural Networks (CNN) [41], Recurrent Neural Networks (RNN) [29], and Artificial Neural Networks (ANN) [16].…”

Section: Machine Learning Techniques For Traffic Classificationmentioning

confidence: 99%

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Holasova,

Fujdiak,

Misurec

2024

Algorithms

View full text Add to dashboard Cite

show abstract

“…Krupski et al [22] have conducted a survey about data transformation schemes for CNN-based network traffic analysis. They categorize approaches into different classes depending on the performed traffic preprocessing to create the input for the CNN.…”

Section: Related Workmentioning

confidence: 99%

HollywooDDoS: Detecting Volumetric Attacks in Moving Images of Network Traffic

Kopmann

Heseding

Zitterbart

2022

2022 IEEE 47th Conference on Local Computer Networks (LCN)

View full text Add to dashboard Cite

Fast detection of Distributed Denial of Service attacks is key for establishing appropriate countermeasures in order to protect potential targets. HollywooDDoS applies wellknown techniques from movie classification to the challenge of DDoS detection. The proposed approach utilizes a traffic aggregation scheme representing traffic volumes between IP subnets as two-dimensional images, while preserving detection relevant traffic characteristics. These images serve as input for a convolutional neural network, learning IP address space distributions of both background and attack traffic intensities. It is shown that a real-world DDoS attack can be precisely detected on the time scale of milliseconds. We evaluate classification of images without temporal information about attack traffic development to outline the impact of image resolution and aggregation time frames. We then show that attack detection further improves by 17% when utilizing a consecutive series of images capturing traffic dynamics.

show abstract

“…Compared to traditional machine learning-based methods, deep learning can automatically and effectively learn and extract complex features from raw data, reducing computational complexity and avoiding manual feature engineering. Currently, a variety of DL models have been applied in network traffic classification, including the convolutional neural network (CNN) [15], recurrent neural network (RNN) [16], autoencoder [17], and attention mechanism (AM) [18], which are widely used to handle high-dimensional and encrypted traffic payload classification tasks. However, technological advancements inevitably bring new challenges.…”

Section: Introductionmentioning

confidence: 99%

The Attention-Based Autoencoder for Network Traffic Classification with Interpretable Feature Representation

Cui,

Bai,

Zhang

et al. 2024

Symmetry

View full text Add to dashboard Cite

Network traffic classification is crucial for identifying network applications and defending against network threats. Traditional traffic classification approaches struggle to extract structural features and suffer from poor interpretability of feature representations. The high symmetry between network traffic classification and its interpretable feature representation is vital for network traffic analysis. To address these issues, this paper proposes a traffic classification and feature representation model named the attention mechanism autoencoder (AMAE). The AMAE model extracts the global spatial structural features of network traffic through attention mechanisms and employs an autoencoder to extract local structural features and perform dimensionality reduction. This process maps different network traffic features into one-dimensional coordinate systems in the form of spectra, termed FlowSpectrum. The spectra of different network traffic represent different intervals in the coordinate system. This paper tests the interpretability and classification performance of network traffic features of the AMAE model using the ISCX-VPN2016 dataset. Experimental results demonstrate that by analyzing the overall distribution of attention weights and local weight values of network traffic, the model effectively explains the differences in the spectral representation intervals of different types of network traffic. Furthermore, our approach achieves the highest classification accuracy of up to 100% for non-VPN-encrypted traffic and 99.69% for VPN-encrypted traffic, surpassing existing traffic classification schemes.

show abstract

Data Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey

Cited by 21 publications

References 120 publications

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

HollywooDDoS: Detecting Volumetric Attacks in Moving Images of Network Traffic

The Attention-Based Autoencoder for Network Traffic Classification with Interpretable Feature Representation

Contact Info

Product

Resources

About