Deep learning-based real-time VPN encrypted traffic identification methods

Guo, Lulu; Wu, Qingxiang; Liu, Shengli; Duan, Ming; Li, Huijie; Sun, Jianwen

doi:10.1007/s11554-019-00930-6

Cited by 38 publications

(29 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, some DL-based models [ 44 , 45 , 52 ] are too simple to achieve good performance. Moreover, some 2D convolution-based CNN [ 47 , 48 ], RNN-based [ 50 ] and LSTM-based [ 51 ] models may be a little complex for the analysis of network traffic data and can reduce generalization ability. In this paper, the proposed 1D-convolution-based fusion model can balance these problems and achieve ideal results.…”

Section: Experiments and Resultsmentioning

confidence: 99%

Malicious Network Behavior Detection Using Fusion of Packet Captures Files and Business Feature Data

Wang

Jin

et al. 2021

Sensors

View full text Add to dashboard Cite

Information and communication technologies have essential impacts on people’s life. The real time convenience of the internet greatly facilitates the information transmission and knowledge exchange of users. However, network intruders utilize some communication holes to complete malicious attacks. Some traditional machine learning (ML) methods based on business features and deep learning (DL) methods extracting features automatically are used to identify these malicious behaviors. However, these approaches tend to use only one type of data source, which can result in the loss of some features that can not be mined in the data. In order to address this problem and to improve the precision of malicious behavior detection, this paper proposed a one-dimensional (1D) convolution-based fusion model of packet capture files and business feature data for malicious network behavior detection. Fusion models improve the malicious behavior detection results compared with single ones in some available network traffic and Internet of things (IOT) datasets. The experiments also indicate that early data fusion, feature fusion and decision fusion are all effective in the model. Moreover, this paper also discusses the adaptability of one-dimensional convolution and two-dimensional (2D) convolution to network traffic data.

show abstract

Section: Experiments and Resultsmentioning

confidence: 99%

Malicious Network Behavior Detection Using Fusion of Packet Captures Files and Business Feature Data

Wang

Jin

et al. 2021

Sensors

View full text Add to dashboard Cite

show abstract

“…In the RNN model, the neurons in the same layer are connected to each other and the output of previous (hidden) layer will be considered in calculating the input of the next layer similar to the input layer. To cater for a greater understanding of time-series traffic classification and threat analysis, RNN may offer a special ability [3,33], shown in Figure 2. e processed data (traffic) are stored and referenced while processing the present data affecting the result.…”

Section: Recurrent Neural Network (Rnn)mentioning

confidence: 99%

“…e simultaneous advancement in hardware and reduction in costs have furthered the analytical capability and scope of ML applications in several fields including network traffic analysis. Of particular interest is the deep learning (DL) paradigm, gaining further adoption in data science, developing artificial intelligence that an influence a wide array of research and development [1,3]. Although still relatively nascent, deep learning primitives are being used to dynamically extract experience models from datasets generated under different environments and infer the underlying logic.…”

Section: Introductionmentioning

confidence: 99%

“…Encrypted data are usually trusted and are not decrypted to maintain data integrity and privacy. Encrypted traffic, however, if not inspected, can be exploited by attackers which can lead to successful network compromise(s) [1][2][3]. Deep learning technology offers a new perspective on the problem where data traffic does not require decryption, but the characteristics of the traffic are analyzed to deal with malicious traffic [1,4].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning

Bakhshi

Ghita

2021

Security and Communication Networks

View full text Add to dashboard Cite

An increasing number of Internet application services are relying on encrypted traffic to offer adequate consumer privacy. Anomaly detection in encrypted traffic to circumvent and mitigate cyber security threats is, however, an open and ongoing research challenge due to the limitation of existing traffic classification techniques. Deep learning is emerging as a promising paradigm, allowing reduction in manual determination of feature set to increase classification accuracy. The present work develops a deep learning-based model for detection of anomalies in encrypted network traffic. Three different publicly available datasets including the NSL-KDD, UNSW-NB15, and CIC-IDS-2017 are used to comprehensively analyze encrypted attacks targeting popular protocols. Instead of relying on a single deep learning model, multiple schemes using convolutional (CNN), long short-term memory (LSTM), and recurrent neural networks (RNNs) are investigated. Our results report a hybrid combination of convolutional (CNN) and gated recurrent unit (GRU) models as outperforming others. The hybrid approach benefits from the low-latency feature derivation of the CNN, and an overall improved training dataset fitting. Additionally, the highly effective generalization offered by GRU results in optimal time-domain-related feature extraction, resulting in the CNN and GRU hybrid scheme presenting the best model.

show abstract

“…Real-time VPN traffic identification has become an increasingly important task in network management and security maintenance. The paper entitled "Deep learningbased real-time VPN encrypted traffic identification methods", co-authored by Guo et al [9], proposes two deep learning-based models to classify the traffic into VPN and non VPN traffic. These models utilize convolutional autoencoding (CAE) and convolutional neural network (CNN) respectively, preprocessing the traffic samples into session pictures, to accomplish the experiment objectives.…”

Section: Forensics On Other Applicationsmentioning

confidence: 99%