OpenCBD: A Network-Encrypted Unknown Traffic Identification Scheme Based on Open-Set Recognition

Abstract

The encryption of network traffic promotes the development of encrypted traffic classification and identification research. However, many existing studies are only effective for closed-set experimental data, that is to say, only for traffic of known classes, while there are often lots of unknown classes traffic in the real environment of open sets, and many studies have difficulty identifying the traffic of unknown classes and can only misclassify them as known classes. How to identify unknown traffic and classify known traffic in an open-collection environment is one of the focuses of traffic analysis research. Considering these problems, this paper proposes a novel solution, which applies the open-set recognition method to the unknown traffic identification, and constructs a model based on deep learning and ensemble learning. The method constructs a model based on a convolutional neural network and a transformer encoder and then uses a three-stage training and testing process, combined with a novel loss function, to generalize to the open space to form OpenCBD. Experiments on public datasets show that the proposed method is significantly better than other open-set identification methods. It can not only distinguish known traffic from unknown traffic but also identify specific classes of known traffic.

A Few-Shot Malicious Encrypted Traffic Detection Approach Based on Model-Agnostic Meta-Learning

“…Lim et al [23] extended the dataset provided by UPC's Broadband Communication Research Group to classify network trafc using convolutional neural network (CNN) and residual network (Resnet) as deep learning models. Hu et al [24] proposed the OpenCBD model based on convolutional neural networks and transformer encoder to identify unknown encrypted trafc and classify known encrypted trafc.…”