Source-linked AI summary
Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning
Mohammad Lotfollahi, Ramin Shirali Hossein Zade, Mahdi Jafari Siavoshani, Mohammdsadegh Saberian
TL;DR
Network traffic classification is important but challenged by encrypted traffic, difficult applications, and reliance on expert-defined features. Deep Packet combines stacked autoencoders and convolutional neural networks to learn features and classify both applications and traffic categories. The authors report state-of-the-art performance on the ISCX VPN-nonVPN dataset across both tasks.
Problem
Network traffic classification must address encrypted traffic, difficult P2P applications, and existing methods' reliance on expert-defined features.
Method
Deep Packet combines stacked autoencoder and convolutional neural network methods for application identification and traffic characterization.
Results
Deep Packet outperformed similar works on the ISCX VPN-nonVPN dataset in both application identification and traffic characterization.
Takeaways & Limitations
Deep Packet provides automatic feature extraction for classifying network traffic at both application and traffic-characterization levels.
Takeaways & Limitations
Prior reviewed studies included incomplete reporting of datasets, methodology, implementation details, or results.
Abstract
from arXiv · showhide
Internet traffic classification has become more important with rapid growth of current Internet network and online applications. There have been numerous studies on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a \emph{deep learning} based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both \emph{traffic characterization} in which the network traffic is categorized into major classes (\eg, FTP and P2P) and application identification in which end-user applications (\eg, BitTorrent and Skype) identification is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. After an initial pre-processing phase on data, packets are fed into Deep Packet framework that embeds stacked autoencoder and convolution neural network in order to classify network traffic. Deep packet with CNN as its classification model achieved recall of $0.98$ in application identification task and $0.94$ in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.
1 Introduction
Network traffic classification is increasingly important but difficult because traffic is diverse, encrypted, and often deliberately obfuscated. Deep Packet addresses these challenges with deep learning that supports both traffic characterization and application identification without expert-defined feature extraction.
- Encrypted traffic is difficult to classify because encryption produces data with few discriminative patterns.
- Expert-defined feature extraction is error-prone, time-consuming, and costly in many existing classification approaches.
- P2P applications are especially challenging to identify because they embed protocols and use obfuscation to bypass traffic-control systems.
- Deep Packet applies deep learning to both traffic characterization and application identification.
- Deep Packet omits expert feature extraction and supports classification at both application and traffic-characterization granularities.
- The paper evaluates Deep Packet on network application identification and traffic characterization tasks.
2 Related Works
Prior traffic-classification research includes port-based, payload-inspection, statistical, and machine-learning approaches, but these methods face coverage, privacy, maintenance, or reporting limitations. Deep Packet builds on stacked autoencoders while targeting both broad traffic classes and individual applications.
- Existing traffic-classification methods include port-based, payload-inspection, statistical, and machine-learning approaches.
- Port-based classification is fast and encryption-resistant, but obfuscation, NAT, forwarding, protocol embedding, and random ports reduce its accuracy to 30%–70% of current Internet traffic.
- Payload inspection relies on predefined signatures, requiring updates for new protocols and raising user-privacy concerns.
- Encrypted-payload inspection without decryption addressed privacy concerns in one approach, but it processed only HTTPS traffic.
- Statistical methods assume applications possess nearly unique statistical features, while machine-learning studies have reported high accuracy on selected traffic tasks.
- Some prior work was limited by human-prone feature engineering and prediction-time concerns for k-NN classifiers.
- Before Deep Packet, only one reported study was identified as using deep-learning ideas for network-traffic classification.
- One reviewed study omitted its dataset, implementation methodology, and proper result reporting.
3 Background on Deep Neural Networks
Deep neural networks provide layered representations for learning from data. Autoencoders support unsupervised feature extraction, stacked autoencoders improve training through layer-wise pretraining and fine-tuning, and CNNs extract local patterns for traffic classification.
- Deep learning uses neural networks with many hidden layers and has become more practical with increased computational power and GPU availability.
- Autoencoder: Autoencoders reconstruct their inputs while minimizing reconstruction error, thereby learning compressed representations of training data.
- Autoencoder: The encoder output serves as a high-level set of discriminative features for downstream classification.
- Stacked Autoencoder: Stacked autoencoders train successive layers greedily with frozen weights, then fine-tune the full network and may add a softmax classification layer.
- Convolutional Neural Network: CNNs extract features through convolutional layers, while pooling can aggregate local features, provide local invariance, and reduce computation.
- Convolutional Neural Network: For network traffic, 1D-CNNs capture dependencies between adjacent packet bytes to identify discriminative protocol and application patterns.
4 Methodology
Deep Packet combines preprocessing with stacked autoencoder and one-dimensional CNN models to classify packet traffic for application identification and traffic characterization. The methodology uses the ISCX VPN-nonVPN dataset, task-specific relabeling, packet normalization, and masked IP addresses before neural-network training.
- Framework: Deep Packet applies stacked autoencoder and one-dimensional CNN models to both application identification and traffic characterization after preprocessing network traffic.The framework uses a pretrained neural network corresponding to the classification task.
- Dataset: The ISCX VPN-nonVPN dataset contains labeled application traffic, activity types, VPN sessions, non-VPN sessions, and Tor traffic.Captured activities include voice calls, video calls, chat, and file transfer.
- Preprocessing: Preprocessing removes Ethernet headers and irrelevant control or DNS segments before packets are supplied to the neural networks.The discarded segments include payload-free TCP handshake or termination packets and DNS segments.
- Preprocessing: Approximately 96% of packets have payloads shorter than 1480 bytes, motivating fixed-length truncation or zero-padding for neural-network input.The packet-length distribution varies substantially, while the networks require fixed-size input.
- Preprocessing: IP addresses are masked to prevent the networks from learning dataset-specific host or server identities as classification features.The masking step is intended to reduce over-fitting to irrelevant address information.
- Labeling Dataset: Application identification produces 17 labels, while traffic characterization uses task-specific aggregation of captured traffic labels.The dataset’s application and activity labels are redefined separately for the two tasks.
- Architectures: The proposed SAE uses five fully connected layers with 400, 300, 200, 100, and 50 neurons, whereas the CNN uses two convolutional layers, pooling, flattening, and three fully connected layers.Dropout is used in the SAE and CNN architectures to reduce over-fitting, and CNN hyperparameters are selected through grid search.
5 Experimental Results
Deep Packet is evaluated on independent test data using recall, precision, and F1 score, with grid search used to select CNN hyperparameters. The reported results show strong performance on both tasks and compare the packet-level approach with prior flow-feature methods.
- Evaluation: Deep Packet models are trained and evaluated against an independent test set extracted from the dataset.The implementation uses Keras with TensorFlow as its backend.
- Evaluation: Recall, precision, and F1 score are the evaluation metrics, with true positives, false positives, and false negatives defining the metric terms.These metrics are used to evaluate the proposed models.
- Hyperparameter Search: 116 CNN models are evaluated in a restricted hyperparameter subspace using weighted average F1 score for both tasks.The search varies filter size, filter count, and stride in both convolutional layers.
- Hyperparameter Search: Increasing neural-network complexity does not necessarily improve evaluation performance, with vanishing-gradient and over-fitting problems identified as possible causes.The figure encodes trainable-parameter counts by color, with darker points representing more parameters.
- Results: The 1D-CNN achieves weighted average F1 scores of 0.98 for application identification and 0.93 for traffic characterization, compared with SAE scores of 0.95 and 0.92.These results are reported on the test set for the two classification tasks.
- Comparison: Deep Packet is reported to outperform similar methods on the ISCX VPN-nonVPN dataset for both application identification and traffic characterization.The comparison includes prior approaches using handcrafted time-related flow features.
- Comparison: The authors question a prior 100% precision result because IP addresses unique to applications may have been exposed through packet headers.Deep Packet masks IP address fields during preprocessing to avoid this issue.
6 Discussion
Deep Packet’s SAE produces largely accurate classifications, while confusion analysis reveals meaningful application similarities and a clear VPN/non-VPN separation. The framework can classify encrypted traffic without decrypting packets, but Tor-specific classification remains limited.
- Classification results: The row-normalized confusion matrices show minor confusion in both application identification and traffic characterization.Rows represent actual classes and columns represent predicted labels; dark diagonal elements indicate accurate classification.
- Application clustering: Hierarchical clustering divided application-identification results into seven groups that generally match real-world application similarities.Streaming applications such as Vimeo, Netflix, YouTube, and Spotify clustered together, as did several communication and file-transfer applications.
- Application clustering: The clustering separated some applications plausibly, including FTPS with SFTP while placing SCP separately because they use different transfer protocols.The authors suggest the network learned this distinction from FTPS and SFTP using FTP, whereas SCP uses SSH.
- Application clustering: The application clustering was not flawless, incorrectly grouping Skype, Facebook, and Hangouts with Email and VoipBuster.The authors state that this grouping was not precise because the applications did not seem sufficiently similar regarding usage.
- Traffic clustering: Traffic-characterization clustering separated all VPN traffic from all non-VPN traffic into distinct clusters.This result indicates that the confusion patterns distinguish the two traffic settings in the evaluated dataset.
- Encrypted traffic: Deep Packet classifies encrypted traffic by learning application-specific traffic features rather than inspecting packet keywords or decrypting packets.The authors attribute this capability to discriminative patterns produced by practical, non-ideal encryption schemes.
7 Conclusion
The conclusion presents Deep Packet as a deep-learning framework that automatically extracts traffic features for both application identification and traffic characterization. The authors report state-of-the-art performance on the ISCX VPN-nonVPN dataset and identify extensions for more complex traffic tasks.
- Conclusion: Deep Packet automatically extracts network-traffic features using deep learning to classify traffic.The framework is presented as integrating feature extraction into the traffic-classification system.
- Conclusion: The framework handles both application identification and traffic characterization using stacked autoencoder and one-dimensional CNN algorithms.The authors describe it as the first traffic-classification system using these deep-learning algorithms for both tasks.
- Conclusion: Deep Packet outperforms similar works on the ISCX VPN-nonVPN dataset for both application identification and traffic characterization, according to the authors.The conclusion also suggests possible extensions to multi-channel classification and more accurate Tor-traffic classification.
- Conclusion: Automatic feature extraction can reduce the cost of using experts to identify and extract handcrafted traffic features.The authors link this cost reduction to more accurate traffic classification.
Compliance with Ethical Standards
The authors report no conflicts of interest and state that the article includes no studies involving human participants or animals.
- Ethical standards: The authors declare that they have no conflict of interest.
- Ethical standards: The article contains no studies with human participants.
- Ethical standards: The article contains no studies involving animals performed by the authors.