Encrypted Traffic Classification with a Convolutional Long Short-Term Memory Neural Network

Zou, Zhuang; Ge, Jingguo; Zheng, Hairong; Wu, Yulei; Han, Chuntan; Yao, Zhaolin

doi:10.1109/hpcc/smartcity/dss.2018.00074

Cited by 85 publications

(42 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is because it is the machine learning area's benchmark value to measure how good the system is to detect. Research conducted by Zou et al [2] combines deep neural networks and recurrent networks to improve the classification results' accuracy. They use a convolutional network for extracting the packet features, and a recurrent network is used to pick out the flow features based on the inputs.…”

Section: Related Workmentioning

confidence: 99%

“…Encryption technique can also be used for allowing every user to avoid firewall detection and system administrator. Nevertheless, besides its benefit, criminals have also used this scheme to do illegal activities [2]. Some attackers implement cryptographic algorithms to encrypt the data containing malware or virus that can anonymously attack the system.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

ANOVA-SVM for Selecting Subset Features in Encrypted Internet Traffic Classification

Megantara¹,

Ahmad²

2021

IJIES

View full text Add to dashboard Cite

Encryption technique is widely used in the internet network for protecting user privacy, maintaining the confidentiality of the data, avoiding firewall detection, and administrating the system. To prevent encryption techniques in malicious activities such as encrypting data that contains malware or viruses, illegal transactions like selling drugs, illegal weapons and fake documents, a company or institution uses encrypted internet traffic classification to analyze and identify the activity. A challenging problem in encrypted internet traffic classification is the massive amount of data in the dataset and the existence of many irrelevant features. In this research, we propose a technique by integrating the ANOVA algorithm with the wrapper method from LinearSVC in the SVM method to overcome this problem. The ANOVA algorithm is used to analyze the data's variance, and LinearSVC to calculate the relationship between each data to its decision boundary. A new technique is proposed by calculating the mean value of the distances to remove features, which are relatively far from the decision boundary. This technique is taken to isolate features from unused ones to be used for the next process. The experimental result shows that this proposed method can compete with the existing research method and reduce system detection time. In this case, we take some research as the baseline, including that with one-dimensional convolution neural networks, over-sampling and undersampling combination, inline and adaptive application, and FlowPic.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

ANOVA-SVM for Selecting Subset Features in Encrypted Internet Traffic Classification

Megantara¹,

Ahmad²

2021

IJIES

View full text Add to dashboard Cite

show abstract

“…Although ensemble learning [32,33] showed good performance, the model based on a weak learner lacked interpretability. Neural networks [34][35][36][37][38][39][40][41][42][43] needed a large amount of data to train a model, which was difficultly to realize in a condition of a small training set. Transfer learning [44] and active learning [45] addressed the issues of model practicability and insufficient label data during training, respectively, but they have not been adequately explored in studies on fine-grained classification.…”

Section: Related Workmentioning

confidence: 99%

Improved KNN Algorithm for Fine-Grained Classification of Encrypted Network Flow

Cao

2020

Electronics

View full text Add to dashboard Cite

The fine-grained classification of encrypted traffic is important for network security analysis. Malicious attacks are usually encrypted and simulated as normal application or content traffic. Supervised machine learning methods are widely used for traffic classification and show good performances. However, they need a large amount of labeled data to train a model, while labeled data is hard to obtain. Aiming at solving this problem, this paper proposes a method to train a model based on the K-nearest neighbor (KNN) algorithm, which only needs a small amount of data. Due to the fact that the importance of different traffic features varies, and traditional KNN does not highlight the importance of different features, this study introduces the concept of feature weight and proposes the weighted feature KNN (WKNN) algorithm. Furthermore, to obtain the optimal feature set and the corresponding feature weight set, a feature selection and feature weight self-adaptive algorithm for WKNN is proposed. In addition, a three-layer classification framework for encrypted network flows is established. Based on the improved KNN and the framework, this study finally presents a method for fine-grained classification of encrypted network flows, which can identify the encryption status, application type and content type of encrypted network flows with high accuracies of 99.3%, 92.4%, and 97.0%, respectively.

show abstract

“…[49]. In reality, LSTM is generally used to integrate the two networks and extract temporal feature information at different levels to achieve better classification results [50].…”

Section: Traffic Classification Based On Long Short-term Memorymentioning

confidence: 99%

Network Traffic Classification Based on Deep Learning

2020

KSII TIIS

View full text Add to dashboard Cite

Encrypted Traffic Classification with a Convolutional Long Short-Term Memory Neural Network

Cited by 85 publications

References 16 publications

ANOVA-SVM for Selecting Subset Features in Encrypted Internet Traffic Classification

ANOVA-SVM for Selecting Subset Features in Encrypted Internet Traffic Classification

Improved KNN Algorithm for Fine-Grained Classification of Encrypted Network Flow

Network Traffic Classification Based on Deep Learning

Contact Info

Product

Resources

About