Deep Learning for Encrypted Traffic Classification: An Overview

Abstract

Traffic classification has been studied for two decades and applied to a wide range of applications from QoS provisioning and billing in ISPs to security-related applications in firewalls and intrusion detection systems. Port-based, data packet inspection, and classical machine learning methods have been used extensively in the past, but their accuracy have been declined due to the dramatic changes in the Internet traffic, particularly the increase in encrypted traffic. With the proliferation of deep learning methods, researchers have recently investigated these methods for traffic classification task and reported high accuracy. In this article, we introduce a general framework for deep-learning-based traffic classification. We present commonly used deep learning methods and their application in traffic classification tasks. Then, we discuss open problems and their challenges, as well as opportunities for traffic classification.

References in corpus (2)

• Active One-shot Learning
• How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets

Cited by in corpus (20)

• ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification
• A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
• Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection
• Large-scale Mobile App Identification Using Deep Learning
• Multitask Learning for Network Traffic Classification
• Active Learning for Network Traffic Classification: A Technical Study
• Fine-grained TLS services classification with reject option
• Graph Mining for Cybersecurity: A Survey
• Intrusion Detection in Internet of Things using Convolutional Neural Networks
• How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets
• The Sweet Danger of Sugar: Debunking Representation Learning for Encrypted Traffic Classification
• Online Network Traffic Classification Based on External Attention and Convolution by IP Packet Header
• Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification
• A Federated Semi-Supervised Learning Approach for Network Traffic Classification
• A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learning
• Time-Distributed Feature Learning for Internet of Things Network Traffic Classification
• Mobile Traffic Classification through Physical Channel Fingerprinting: a Deep Learning Approach
• LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis
• Improving the network traffic classification using the Packet Vision approach
• Time-Distributed Feature Learning in Network Traffic Classification for Internet of Things