基于半监督学习的加密流量分类模型CLGAN

Encrypted Traffic Classification Model CLGAN Based on Semi-Supervised Learning

摘要: 加密流量的快速增长和复杂化对网络流量分类提出了新的挑战。针对现有方法在加密流量分类中特征提取能力不足和标注数据需求量大的问题，文章提出了一种基于生成对抗网络(GAN)的半监督加密流量分类模型CLGAN。通过对GAN网络中的判别器使用CNN与LSTM级联结构，模型能够有效结合卷积神经网络(CNN)的空间特征提取能力与长短时记忆网络(LSTM)的时序特征捕获能力，从而提升分类性能。在公开数据集ISCX2012 VPN-nonVPN和USTC-TFC2016上，分别与半监督学习模型DCGAN、基于AE的半监督学习模型以及监督学习模型CNN-LSTM进行对比实验。实验结果表明：CLGAN在标注数据稀缺场景下表现出更强的特征提取和泛化能力。当标记样本数量为2000时，CLGAN的分类准确率比CNN-LSTM模型提高了约3%；与模型DCGAN相比，在不同数据标记数量下CLGAN模型分类准确率均提高了约4%。

Abstract: The rapid growth and complexity of encrypted traffic pose new challenges to network traffic classification. Aiming at the problems of insufficient feature extraction ability and great demand for labeled data in existing methods for encrypted traffic classification, this paper proposes a semi-supervised encrypted traffic classification model CLGAN based on the Generative Adversarial Network (GAN). By using a cascade structure of Convolutional Neural Network (CNN) and Long Short-Term Memory network (LSTM) in the discriminator of the GAN network, the model can effectively combine the spatial feature extraction ability of the CNN and the temporal feature capture ability of the LSTM, thus improving the classification performance. Comparative experiments are conducted on the public datasets ISCX2012 VPN-nonVPN and USTC-TFC2016, comparing with the semi-supervised learning model DCGAN, the semi-supervised learning model based on Autoencoder (AE), and the supervised learning model CNN-LSTM. The experimental results show that CLGAN exhibits stronger feature extraction and generalization capabilities in scenarios where labeled data is scarce. When the number of labeled samples is 2000, the classification accuracy of CLGAN is approximately 3% higher than that of the CNN-LSTM model; compared with the DCGAN model, the classification accuracy of the CLGAN model is approximately 4% higher under different numbers of labeled data.