CD-Net: Robust mobile traffic classification against apps updating

Abstract

Mobile traffic classification (MTC) is an increasingly important domain in traffic filtering and malware detection. Existing methods have achieved good results in distribution-invariant MTC. However, as apps update rapidly and users’ update time varies, the traffic of a certain app often consists of multiple versions mixed together in the real-world network. This dynamic proportion of new-version app traffic significantly affects the performance of models, even if they have been retrained with new-version app traffic. In this paper, we propose CD-Net, a robust encrypted MTC method designed to classify the mixed traffic of multi-version apps. CD-Net is based on the few-shot framework and primarily comprises two components: the CNN part for feature extraction and the DNN part for classification. When an app is updated, the DNN part is retrained to classify the new-version app, while the CNN part remains unchanged to ensure the ability to classify the original-version app. We collected a real-world dataset to validate the effectiveness of our proposed CD-Net. Before retraining with the new-version app traffic, the accuracy of all models declined during the process of an app update. However, after retraining the DNN part with a few samples of the new-version app traffic, the F1-Score of our model remained above 93.68% throughout the app update process, while the F1-Score of the retrained state-of-the-art method dropped to 88.28%.