A balanced supervised contrastive learning-based method for encrypted network traffic classification

Abstract

Encrypted network traffic classification plays an important role in enhancing network security and improving network performance. However, the imbalanced nature of traffic data makes the classification of encrypted network traffic challenging and may result in poor classification performance. Existing encrypted network traffic classification studies attempt to rebalance the data distribution through resampling strategies, which suffer from information loss, overfitting, and increased model complexity. Motivated by this, we propose an improved supervised contrastive learning approach to improve the classification performance of supervised contrastive learning classifiers for the traffic class imbalance problem in encrypted network traffic classification. Our method consists of two parts: data processing and traffic classification. In the data processing stage, we transform the raw network traffic data into grayscale images. In the traffic classification stage, we design optimized class-complement and class-averaging schemes in supervised contrastive learning. The construction of contrastive tasks is a critical link in contrastive learning. However, when constructing the set of positive and negative samples of network traffic, the samples generated by traditional methods do not conform to the salient features of network traffic. Traditional methods typically involve color modification, cropping, rotation, noise injection, and random erasure. When these traditional methods are applied to images generated from network traffic data, they may alter significant features of the network traffic data, such as changing the distribution of packet sizes. This is detrimental to maintaining the characteristics of traffic classes and does not aid the learning process. Therefore, we preprocess the traffic into images in a particular format suitable for contrastive learning, and then design a novel contrastive task construction method. The evaluation results on public datasets show that the proposed method can significantly improve the classification performance of encrypted traffic classification on imbalanced datasets.