PaperlayerView exact revision on arXiv

Source-linked AI summary

Autonomous Unknown-Application Filtering and Labeling for DL-based Traffic Classifier Update

Jielun Zhang, Fuhao Li, Feng Ye, Hongyu Wu

arXiv:2002.06359v1cs.NIeess.SP

TL;DR

Closed-world traffic classifiers do not correctly classify unknown application classes, creating an open-world update problem. The paper proposes filtering, discriminating, clustering, and self-labeling packets to update DL classifiers; its evaluation reports successful unknown-class clustering and high classification performance for new classes.

Abstract

from arXiv · show

Network traffic classification has been widely studied to fundamentally advance network measurement and management. Machine Learning is one of the effective approaches for network traffic classification. Specifically, Deep Learning (DL) has attracted much attention from the researchers due to its effectiveness even in encrypted network traffic without compromising neither user privacy nor network security. However, most of the existing models are created from closed-world datasets, thus they can only classify those existing classes previously sampled and labeled. In this case, unknown classes cannot be correctly classified. To tackle this issue, an autonomous learning framework is proposed to effectively update DL-based traffic classification models during active operations. The core of the proposed framework consists of a DL-based classifier, a self-learned discriminator, and an autonomous self-labeling model. The discriminator and self-labeling process can generate new dataset during active operations to support classifier update. Evaluation of the proposed framework is performed on an open dataset, i.e., ISCX VPN-nonVPN, and independently collected data packets. The results demonstrate that the proposed autonomous learning framework can filter packets from unknown classes and provide accurate labels. Thus, corresponding DL-based classification models can be updated successfully with the autonomously generated dataset.

I. INTRODUCTION

Traffic classification supports network measurement and management, but dynamic ports, encryption, and changing application traffic challenge traditional approaches. Although machine-learning methods address some of these issues, the section identifies feature-selection and accuracy limitations.

A. Traditional Traffic Classification

  • Port-based and payload-based classification become less effective with dynamic port assignments and encrypted payloads.The related-work discussion also cites port translation and encryption as reasons traditional approaches fail.Source: §I · p. 1, A. Traditional Traffic Classification · p. 2

I. INTRODUCTION

  • Closed-world DL classifiers can become less accurate as new applications appear because they cannot identify unknown classes.The introduction frames this as an open-world problem for traffic classification.Source: §I · p. 1

B. Machine Learning based Traffic Classification

  • Machine-learning traffic classifiers use packet features such as size and interarrival time, but usually have low accuracy and require manual feature selection.Prior work cited in the section reports 94% average accuracy alongside relatively high feature-extraction overhead.Source: B. Machine Learning based Traffic… · p. 2

C. Deep Learning based Traffic Classification

The section frames open-world classification as updating DL classifiers to handle newly appearing applications. It also reviews DL traffic models and the CNN components used in the paper’s preliminaries.

C. Deep Learning based Traffic Classification

  • DL traffic classifiers can exceed 95% average accuracy, yet prior classification problems mostly assume a closed world and need prompt updating for open-world traffic.The section states that prompt updates support accurate traffic classification for network measurement and management.Source: C. Deep Learning based Traffic… · p. 2

A. Open-world Packet Classification

  • Updating a classifier requires filtering unknown packets, identifying the number of discovered classes, and updating the model to include them.The formulation defines a new dataset containing existing and discovered classes for the updated classifier.Source: A. Open-world Packet Classification · p. 2

B. Preliminaries (Convolutional Neural Network)

  • CNNs extract features with convolutional layers, while ReLU supplies nonlinearity and the paper removes pooling to retain details in small raw packets.The preliminaries describe dense layers and Softmax as producing class probabilities and final classification results.Source: B. Preliminaries (Convolutional Neural… · pp. 2–3

IV. AUTONOMOUS MODEL UPDATING FRAMEWORK

The proposed framework uses classifier confidence scores to help discriminate unknown applications, then clusters and self-labels discovered packets for a new training dataset. The discriminator combines a confidence-based boundary with a learned binary classifier.

IV. AUTONOMOUS MODEL UPDATING FRAMEWORK

  • The framework has three stages: DL packet classification, unknown-application discrimination, and autonomous packet self-labeling for classifier updating.The gateway classifier supplies confidence scores used by the discriminator; discovered packets are clustered and self-labeled into a generated dataset.Source: §IV · p. 3

A. Deep Learning based Traffic Classifier

  • Most known-class confidence scores lie near 1, while unknown-class scores are distributed uniformly, enabling confidence-based pre-filtering of unknown packets.The pre-filtered samples train a discriminator to further cluster and label unknown classes.Source: A. Deep Learning based Traffic… · pp. 3–4

B. Self-learning Discriminator

  • The discriminator uses θ, where the known-class confidence CDF reaches 1−ǫ, to treat packets below θ as discovered-class samples.It is designed as a DL-based binary classifier distinguishing current and unknown packets.Source: B. Self-learning Discriminator · p. 4

10 end

The described discriminator is trained using known-class samples and filtered unknown-class packets, then used to classify remaining packets above the confidence boundary.

10 end

  • The algorithm excerpt specifies that discriminator D(pi) is trained with the two listed labeled pairs, {Dt,0} and {PL n,1}, without identifying their sample contents.Source: §10 · p. 4

16 end

  • Packets above the boundary are classified by the trained discriminator, and those identified as unknown are added to the discovered-packet set.The resulting sets are merged into the collection of possible discovered classes.Source: §16 · p. 4

C. Autonomous Unknown Packet Self-Labeling

The label assigner reduces features from filtered unknown-class packets and clusters them to assign labels. PCA is used to reduce feature dimensionality before extracting principal components.

C. Autonomous Unknown Packet Self-Labeling

  • The label assigner extracts low-dimensional features from filtered packets, clusters them into groups, and assigns labels; actual application identities remain unknown unless users or providers share them.Source: C. Autonomous Unknown Packet… · p. 4

1) Feature Dimension Reduction:

  • PCA is adopted for computational efficiency, though Stacked Autoencoder and Reconstruction Independent Component Analysis are also possible dimension-reduction schemes.Source: 1) Feature Dimension Reduction · p. 4
  • Feature maps from a dense layer are combined across packets into Y, whose packet feature vectors each contain W values, where W is the dense-layer neuron count.Source: 1) Feature Dimension Reduction · p. 4
  • The first q columns of H represent principal information, with q setting the dimension of the extracted principal components.Source: 1) Feature Dimension Reduction · p. 4

2) Autonomous Clustering:

The clustering process groups extracted features by similarity and selects a cluster count using Bayesian information criterion (BIC).

2) Autonomous Clustering:

  • K-means clusters extracted features into groups, with each discovered class represented by a centroid calculated from its samples.Source: 2) Autonomous Clustering · pp. 4–5
  • A smaller Euclidean distance indicates a closer relationship between principal components, while a larger distance indicates lower similarity.Source: 2) Autonomous Clustering · p. 5
  • BIC evaluates candidate cluster models across enumerated k values up to Kmax, and the model with the greatest BIC decrease determines the optimal cluster count.Source: 2) Autonomous Clustering · p. 5

D. New Dataset Generation and Model Update

The new dataset combines previously labeled data with newly discovered packets and their assigned labels. Transfer learning carries current-model parameters forward to update the classifier.

D. New Dataset Generation and Model Update

11 EndFor

The update procedure assigns labels to packets in each discovered unknown class and trains a resized classifier on the new dataset.

11 EndFor

  • Packets in each clustered unknown class receive the label assigned to that class by the selected clustering model.Source: §11 · p. 5
  • The update algorithm loads the new dataset and current model layers and weights, then resizes the final dense and Softmax layers.Source: §11 · p. 5
  • The modified layers are saved and the updated classifier is trained with the new dataset.Source: §11 · p. 5

8 end

The evaluation combines packets from ISCX VPN-nonVPN with newly captured encrypted application traffic, then compares packet representations and classifier designs.

A. Dataset for Evaluation

  • The evaluation dataset includes 206,688 ISCX VPN-nonVPN packets and 492,721 newly captured packets from five applications.The captured applications are Google Map, Speedtest by Ookla, Tencent QQ, Discord, and DOTA2; the first 24 packet bytes are removed to focus on encrypted payload.Source: A. Dataset for Evaluation · pp. 5–6

B. Design of Classification Model

1) Experiment Environment:

  • Evaluation ran in Matlab 2019a on Windows 10 with a workstation CPU, 32 GB RAM, SSD, and NVIDIA GeForce GTX 1080 Ti.A docked NVIDIA GeForce GTX 1080 connected to an ultrabook was also used to evaluate classifier processing speed.Source: 1) Experiment Environment · p. 6

2) Evaluation Metrics:

The evaluation compares classifier updates across three scenarios and assesses clustering, classification, and computational performance. The 3D-CNN performs best overall, while Scenario C achieves a 97% average for new-class classification.

2) Evaluation Metrics:

  • Recall, precision, and F measure assess clustering and updated classifiers; Rand Index weights false positives and false negatives equally, unlike F measure's greater penalty for false negatives.The paper sets β = 1 for F measure.Source: 2) Evaluation Metrics · p. 6

D. Evaluation Results

  • The 3D-CNN-based classifier has the best overall performance because of its high classification accuracy and computational efficiency, although MLP leads in computational efficiency, followed by 3D-CNN.The comparison covers MLP, 1D-CNN, 2D-CNN, and 3D-CNN-based classifiers in all proposed scenarios.Source: D. Evaluation Results · p. 7
  • Scenarios combine existing and unknown packets: P1 and P3 train and validate, P2 and P4 simulate active traffic, and P5 tests the updated classifier.P5 contains unknown-class packets and is combined with P4 and P3 for testing.Source: Table III · p. 6, D. Evaluation Results · p. 7
  • The proposed scheme clusters multiple unknown classes using packets filtered by the discriminator.For 3D-CNN, the process retains 95% of feature-map content using the first seven PCA components, then applies K-means with the cluster count determined autonomously.Source: Figure 4 · p. 7, Table V · p. 7, D. Evaluation Results · p. 8
  • 97% average new-class classification was reached in Scenario C.In Scenarios A and B, almost all new classes were classified properly; Google Map accuracy was relatively lower because its packets resembled another unknown application in Scenario A.Source: Figure 5 · p. 8, D. Evaluation Results · p. 9

VI. CONCLUSION

The proposed framework filters packets from unknown classes, clusters them into corresponding classes, and assigns labels. Those packets and existing-class packets form a new dataset for updating DL-based classifiers, which the evaluation finds can classify unknown-class packets in active networks.

VI. CONCLUSION

  • The framework updates DL-based classifiers using a new dataset built from filtered and labeled unknown-class packets and existing-class packets.Evaluation used real-life captured packets and an open dataset across three scenarios.Source: §VI · p. 9

Related papers

Loading 2002.06359v1…