Improved KNN Algorithm for Fine-Grained Classification of Encrypted Network Flow

Abstract

The fine-grained classification of encrypted traffic is important for network security analysis. Malicious attacks are usually encrypted and simulated as normal application or content traffic. Supervised machine learning methods are widely used for traffic classification and show good performances. However, they need a large amount of labeled data to train a model, while labeled data is hard to obtain. Aiming at solving this problem, this paper proposes a method to train a model based on the K-nearest neighbor (KNN) algorithm, which only needs a small amount of data. Due to the fact that the importance of different traffic features varies, and traditional KNN does not highlight the importance of different features, this study introduces the concept of feature weight and proposes the weighted feature KNN (WKNN) algorithm. Furthermore, to obtain the optimal feature set and the corresponding feature weight set, a feature selection and feature weight self-adaptive algorithm for WKNN is proposed. In addition, a three-layer classification framework for encrypted network flows is established. Based on the improved KNN and the framework, this study finally presents a method for fine-grained classification of encrypted network flows, which can identify the encryption status, application type and content type of encrypted network flows with high accuracies of 99.3%, 92.4%, and 97.0%, respectively.

On-line Detection and Classification of PMSM Stator Winding Faults Based on Stator Current Symmetrical Components Analysis and the KNN Algorithm

“…These distance metrics are expressed by Equations ( 1)-(4), respectively. The most popular distance metric is the Minkowski distance [59]. Algorithm 1 presented below defines the basic KNN classifier algorithm steps in detail [60].…”

Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study

“…Stergiopoulos et al [14] conducted comparative experiments by using seven different supervised learning algorithms such as k-nearest neighbors (KNN), Classification And Regression Trees (CART), and Naïve Bayes to detect malicious traffic from a dataset with more than one encryption protocol. Ma et al [32] proposed an enhanced KNN algorithm to train an encrypted traffic detection model, which enhances the KNN distance calculation. For unsupervised Learning, Chen et al [13] proposed an improved density peaks clustering algorithm to enhance the accuracy and efficiency of encrypted malicious traffic detection.…”

“…Their experiments indicate that the small number of features can achieve similar accuracy as compared to other existing methods. Many research [13][20] [32] are designed to use machine selection on the optimal features chosen from a large set of extracted features without human intervention. On the other hand, [9][10] [37][44] [47] directly used raw data as the deep learning methods input.…”

ICLSTM: Encrypted Traffic Service Identification Based on Inception-LSTM Neural Network

“…The literature [18] proposed a multi-level P2P traffic classification technique using C4.5 decision trees and statistical features of flows for P2P classification, which was also applicable to encrypted traffic. Similarly, there is literature [19,20] that used machine learning (KNN, SVM) for fine-grained classification of encrypted traffic classification. However, the machine learning-based methods relies heavily on effective feature extraction and selection, which is a waste resource for traffic feature extraction.…”

“…To better analyze the performance of ICLSTM on encrypted traffic service identification, we compare with the results of other methods proposed in recent studies. Such as 1DCNN, Text Convolution [39] and SAE [19], and so forth. The results are shown in the following table.…”