SHAPE: A Simultaneous Header and Payload Encoding Model for Encrypted Traffic Classification

被引:8
作者
Dai, Jianbang [1 ]
Xu, Xiaolong [2 ]
Gao, Honghao [3 ]
Wang, Xinheng [4 ]
Xiao, Fu [2 ]
机构
[1] Nanjing Univ Posts & Telecommun, Jiangsu Key Lab Big Data Secur & Intelligent Proc, Nanjing 210023, Peoples R China
[2] Nanjing Univ Posts & Telecommun, Sch Comp Sci, Nanjing 210023, Peoples R China
[3] Shanghai Univ, Sch Comp Engn & Sci, Shanghai 200444, Peoples R China
[4] Xian Jiaotong Liverpool Univ, Sch Adv Technol, Suzhou 215123, Peoples R China
来源
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT | 2023年 / 20卷 / 02期
基金
中国国家自然科学基金;
关键词
Traffic classification; encrypted traffic; autoencoder; transformer; deep metric learning; NETWORK;
D O I
10.1109/TNSM.2022.3213758
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
Many end-to-end deep learning algorithms seeking to classify malicious traffic and encrypted traffic have been proposed in recent years. End-to-end deep learning algorithms require a large number of samples to train a model. However, it is hard for existing methods fully utilizing the heterogeneous multimodal input. To this end, we propose the SHAPE model (simultaneous header and payload encoding), which mainly consists of two autoencoders and a transformer layer, to improve model performance. The two auto encoders extract features from heterogeneous inputs-the statistical information of each packet and byte-form payloads-and convert them into a unified format; then, a lightweight Transformers layer further extracts the relationship hidden in simultaneous input. In particular, the autoencoder for payload feature extraction contains several depthwise separable residual convolution layers for efficient feature extraction and a token squeeze layer to reduce the computing overhead of the Transformers layer. Moreover, we train the SHAPE model using deep metric learning, which pulls samples with the same class label together and separates samples from different classes in the low-dimensional embedding space. Thus, the SHAPE model can naturally handle multitask classification, and its performance is approximately 5.43% better than the current SOTA on the traffic type classification of the ISCX-VPN2016 dataset, at the cost of 9.31 times the training time, and 1.45 times the inference time.
引用
收藏
页码:1993 / 2012
页数:20
相关论文
共 46 条
[1]   DISTILLER: Encrypted traffic classification via multimodal multitask deep learning [J].
Aceto, Giuseppe ;
Ciuonzo, Domenico ;
Montieri, Antonio ;
Pescape, Antonio .
JOURNAL OF NETWORK AND COMPUTER APPLICATIONS, 2021, 183
[2]   Toward effective mobile encrypted traffic classification through deep learning [J].
Aceto, Giuseppe ;
Ciuonzo, Domenico ;
Montieri, Antonio ;
Pescape, Antonio .
NEUROCOMPUTING, 2020, 409 :306-315
[3]   MIMETIC: Mobile encrypted traffic classification using multimodal deep learning [J].
Aceto, Giuseppe ;
Ciuonzo, Domenico ;
Montieri, Antonio ;
Pescape, Antonio .
COMPUTER NETWORKS, 2019, 165
[4]   Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges [J].
Aceto, Giuseppe ;
Ciuonzo, Domenico ;
Montieri, Antonio ;
Pescape, Antonio .
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, 2019, 16 (02) :445-458
[5]  
Al Khater Noora, 2015, 2015 Tenth International Conference on Digital Information Management (ICDIM). Proceedings, P43, DOI 10.1109/ICDIM.2015.7381869
[6]  
[Anonymous], 2017, P IEEE C NETW SOFTW, DOI DOI 10.1109/NETSOFT.2017.8004227
[7]  
Balntas V., 2016, BMVC, DOI 10.5244/C.30.119
[8]  
Bovenzi G, 2021, Arxiv, DOI arXiv:2107.04464
[9]   Real-Time Encrypted Traffic Classification via Lightweight Neural Networks [J].
Cheng, Jin ;
He, Runkang ;
Yuepeng, E. ;
Wu, Yulei ;
You, Junling ;
Li, Tong .
2020 IEEE GLOBAL COMMUNICATIONS CONFERENCE (GLOBECOM), 2020,
[10]   Issues and Future Directions in Traffic Classification [J].
Dainotti, Alberto ;
Pescape, Antonio ;
Claffy, Kimberly C. .
IEEE NETWORK, 2012, 26 (01) :35-40