Encrypted Traffic Classification Based on Traffic Reconstruction

Abstract

Network traffic classification is to classify network traffic into related traffic types, which plays a significant role in network management and network security. It can guarantee the quality of service of the network, and guarantee network security by intercepting malware traffic. The extensive usage of encryption techniques and the continuous update of encryption protocols make encrypted traffic classification become a new challenge. In this paper, we propose an encrypted traffic classification method based on traffic reconstruction, which can achieve encrypted network traffic with high precision. The main idea of this method is to extract the first 500 bytes of the payload as key data, and insert the length threshold identifier in the payload header, thenan one-dimensional convolutional neural network is used to classify the reconstructed traffic. We use the public dataset ISCX VPN-nonVPN and self-collected dataset to verify our proposed method. The experiment results show that our proposed method can achieve encrypted traffic characterization by F1 score of 98.5%, and achieve encrypted traffic application classification by F1 score of 98.91%.