A lightweight model for encrypted traffic classification through sequence modeling

Abstract

With the increasing awareness of privacy protection in recent years, various encryption techniques are gradually applied to network traffic, which makes encrypted traffic classification an indispensable part of network management. Recent studies show that the approaches based on deep learning are compelling for the traffic classification task. However, most of them take the encrypted payload as input, which not only requires high computational overhead to make classification, but also limits the performance improvement due to the unavailability of the plaintext. In this paper, we treat the encrypted traffic as sequences and solve the classification task from the perspective of sequence modeling, which only depends on several sequence fields obtained from the traffic header. We properly design a lightweight model and name it TGA by its structure, which consists of a temporal convolutional network (TCN), a gated recurrent unit (GRU) and the attention mechanism. TGA first extracts short-term features from sequences by applying the TCN, and then captures the long-term dependencies by exploiting the GRU, and finally focuses on valuable features through dynamic assignment of attention weights. Through these three steps, TGA is expected to obtain the most effective but lightest temporal features. Experimental results on the public dataset demonstrate that TGA shows superiority in terms of classification accuracy and time efficiency, while the number of parameters is reduced to at most 30% of the state-of-the-art models.