基于多阶段神经网络的加密流量分类

Encrypted Traffic Classification Based on Multi-Stage Neural Networks

摘要: 随着加密技术的普及，准确分类加密流量对于识别匿名网络应用程序和防止网络犯罪至关重要。现有方法局限于专家经验或局部数据包信息，无法理解数据包之间的依赖关系。为解决这个问题，提出了多阶段神经网络流量分类器(MSNTC)，使用卷积神经网络(CNN)将会话图像拆分为数据包序列，长短时记忆网络(LSTM)获取流量上下文嵌入，自我注意力机制获得多通道特征图，再利用多尺度卷积神经网络聚合全局信息。在ISCX-VPN和ISCX-Tor数据集上对MSNTC模型进行评估，并与其他方法对比。实验结果表明，MSNTC模型在网络流量分类任务中展现出更好性能，验证了其优越性和通用性。

Abstract: With the proliferation of encryption technology, the accurate classification of encrypted traffic is of vital importance for the identification of anonymous network applications and the prevention of cybercrime. Existing methods are limited to expert experience or partial packet information, thereby failing to comprehend the interdependencies between packets. To address this issue, a novel multi-stage neural network traffic classifier (MSNTC) is proposed, wherein convolutional neural networks (CNN) are employed to decompose session images into packet sequences, long short-term memory networks (LSTM) capture traffic context embeddings, self-attention mechanisms obtain multi-channel feature maps, and multi-scale convolutional neural networks are utilized to aggregate global information. The MSNTC model is evaluated on the ISCX-VPN and ISCX-Tor datasets and compared with other deep learning methods. Experimental results demonstrate the superior performance of the MSNTC model in network traffic classification tasks, thereby corroborating its superiority and universality.