Encrypted Traffic Classification Model Based on SwinT-CNN

Abstract

With the rapid development of the network, the proportion of encrypted traffic in the network is increasing, which brings great challenges to traffic classification. The traditional encrypted traffic classification algorithm extracts the port number of the traffic or the load information of the traffic packet for feature matching, which has no effect in the current encrypted traffic. The encrypted traffic classification algorithm based on machine learning especially relies on the features extracted by professionals for encrypted traffic, which is inefficient and has low accuracy. And, The accuracy and overall performance of existing deep learning methods also need to be improved. Therefore, in order to improve the accuracy of encrypted traffic classification, this paper proposes an encrypted traffic classification method based on deep learning, which tries to combine the core modules of CNN and Swin Transformer with the encrypted traffic classification model to realize the identification of the application type of encrypted traffic. Among them, the CNN module is able to capture the local spatial information characteristics of encrypted traffic data. The multi-head attention mechanism of Swin Transformer can capture global information about the association between attributes of the data. The model is tested on the public ISCX VPN-nonVPN encryption dataset to evaluate the performance of the proposed model. Experimental results show that the accuracy of our proposed model reaches 96.7%. Compared with the other best-performing deep learning models, the proposed model improves the accuracy by 3.1% and the F1 value by 2.7%.