Identification of Encrypted and Malicious Network Traffic Based on One-Dimensional Convolutional Neural Network

doi:10.21203/rs.3.rs-2495959/v1

Download PDF

Research Article

Identification of Encrypted and Malicious Network Traffic Based on One-Dimensional Convolutional Neural Network

https://doi.org/10.21203/rs.3.rs-2495959/v1

This work is licensed under a CC BY 4.0 License

Journal Publication

published 10 Apr, 2023

Read the published version in Journal of Cloud Computing →

You are reading this latest preprint version

The rapid development of the internet has brought a significant increase in network traffic, but the efficiency of categorizing different types of network traffic has lagged behind, which has downgraded cyber security. How to identify different dimensions of network traffic data with more efficiency and accuracy remains a challenging issue. We design a convolutional neural network model HexCNN-1D that combines normalized processing and attention mechanisms. By adding the attention mechanism modules Global Attention Block (GAB) and Category Attention Block (CAB), different dimensions were introduced to classify and recognize network traffic. By extracting effective load information from hexadecimal network traffic, we designed to identify most of the network traffic, including encrypted and malicious traffic data. The experimental results show that the average accuracy is 98.8%. This method can greatly improve the recognition rate of different dimensions of network traffic data.

Network Traffic identification

Convolutional Neural Network

Attention Mechanism

Traffic Data Format Conversion

Recent years have witnessed booming growth on the Internet, especially in network traffic volume and network structure, which brings up new challenges for network traffic monitoring and related issues. Firstly, cyber security must possess the capability to identify and block intrusive traffic data [1, 2]. Network security analysis of network traffic mainly includes the identification of malicious network traffic to prevent malicious network attacks resulting in significant economic losses [3, 4]. Secondly, identification and classification of network traffic with higher accuracy will improve network Quality of Service (QoS) and enable efficient traffic monitoring along with resource allocation. Thirdly, network traffic identification can be applied to industrial Internet, Internet of Things (IoT), and cloud/edge network systems as well [5]. Accurate traffic identification has been recognized as a crucial technology in improving Quality of Service (QoS) of the network [6, 7]. To solve the problems above, many network traffic identification methods have been proposed. Among the proposed methods, those based on machine learning possess the most promising prospects [8].

According to the works published recently, the methods of identifying network traffic mostly focused on the training of machine learning models, such as convolutional neural networks, recurrent neural networks, decision trees, etc. Although machine learning models can greatly accelerate the extraction of network traffic characteristics [9], most existing solutions do not take the processing of the network traffic data format itself into account.

Our contributions are as follows:

In the model data processing, we introduced the normalization processing module to solve the problem of insufficient and unbalanced data distribution caused by the small difference of network traffic categories.

In the model design, we introduced the adjusted global attention block (GAB) and Category attention block (CAB) to deal with more detailed encrypted traffic and malicious traffic category data information.

We designed four different network experiment environments to identify conventional traffic, encrypted traffic, malicious traffic, mixed traffic, etc., so that it can detect and classify different network traffic categories more efficiently. The classification results are compared with other advanced methods. The results show that our model can identify and classify network traffic data categories with high precision.

The rest of this paper is structured as follows: The second section discusses the related work. The third section introduces the data preprocessing. The sixth part is experimental data and index setting. The fourth and fifth sections respectively introduce the convolutional neural network model [10] HEXCNN-1D and the batch normalization and attention mechanism module we added after adjustment. The seventh part analyzes the experimental results. Part eighth discusses future work and improvements.

There are four main network traffic classification methods [11, 12, 13]: methods based on port identification [14], methods based on deep packet detection [15], methods based on statistical processing [16], and methods based on behavior [17]. Most network protocol ports are based on security policies; thus, the identification accuracy of such methods based on port identification is low, and the method based on deep packet detection cannot process the current encrypted network traffic data. With the ubiquitous usage of machine learning [18, 19, 20], researchers are looking into approaches based on statistical processing and norms of behavior.

Traditional network traffic classification methods include clustering, support vector machines, C4.5 Decision Tree (C4.5), and so on. Anshu Priya et al. [21] proposed using the K-Means clustering algorithm to analyze real-time network data traffic situations in universities. Wang et al. [22] used C4.5 for describing application behavior features to classify p2p traffic. Coull et al. [23] proposed classifying p2p traffic by analyzing packet features to propose traffic analysis of encrypted messaging services: Apple iMessage and other message classification. Mauro et al. [24] proposed to reveal encrypted WebRTC traffic by machine learning tools, using the random forest approach. Deep learning has played an increasingly important role in machine learning since its implementation. Convolutional neural networks (CNN), recurrent neural networks (RNN), and long and short-term memory network (LSTM) models are excellent in the field of computer vision. Because traditional feature-based statistical classifiers have become increasingly unsuitable for today’s massive data processing.

Deep learning has gradually been combined with more research fields to generate more efficient network models due to its powerful function extraction ability and efficient model parameter calculation. Shi Dong et al. [25] proposed an optimization method for abnormal network traffic detection based on a semi-supervised double-depth Q-network (SSDDQN). On the basis of the above, Shi Dong [26] proposed an improved support vector machine (SVM) algorithm, called the cost-sensitive support vector machine (CMSVM), to solve the imbalance problem in network traffic identification. Wang et al. [27, 28] for feature extraction of raw traffic data after preprocessing in two dimensions of CNN-1D and CNN-2D. The authors demonstrated the superiority of these two methods by observing the accuracy rates in the experimental evaluation metrics, etc., and achieved a significant improvement over traditional network traffic classification techniques. Lotfollahi et al. [29] proposed Deep Packet: a new method for cryptographic traffic classification using deep learning. Zou et al. [30] proposed a method for cryptographic traffic classification based on convolutional long and short term memory neural networks. Bu et al. [31] proposed a deep parallel network (NIN) neural network model. A micronet work was used to improve local feature extraction following each convolutional layer in a convolutional neural network (CNN). The traditional full connection layer is being replaced by average pooling. It can recognize and categorize encrypted traffic.

There are many common traffic classification methods, each with its own advantages and disadvantages. For example, the classification method based on port number is the simplest to implement, but the identification accuracy is low and the scope of application is limited. The classification method based on deep packets has high precision but cannot detect encryption services. Therefore, there is more upcoming research focusing on network traffic classification and identification using machine learning methods. As a part of machine learning, researchers are trying to apply deep learning to the field of network traffic recognition technology. In this paper, a lightweight neural network model is designed to identify classified network traffic data types.

Hexadecimal Data of Network Traffic Conversion

The ISCX-VPN-NonVPN-2016 and USTC-TFC2016 datasets are used in this paper. As shown in Table 1, we selected the following nine data streams by category in the ISCX-VPN-NonVPN-2016 dataset: AIM, Facebook, Email, Netflix, Hangouts, YouTube, Skype, Vimeo, and Spotify, and packets corresponding to the nine data flows encapsulated through the VPN.

Table 1

The Data Used In ISCX-VPN-NonVPN-2016
Class Option	The Numerical	Class Option	Numerical
AIM	4869	VPN-AIM	5000
Email	5000	VPN-Email	5000
Facebook	5000	VPN-Facebook	5000
Hangout	5522	VPN-Hangout	5016
Netflix	5000	VPN-Netflix	5031
Skype	5000	VPN-Skype	5009
Spotify	5000	VPN-Spotify	5022
Vimeo	5000	VPN-Vimeo	5014
YouTube	5000	VPN-YouTube	5000

Table 2

The Data Used In USTC-TFC2016
Class Option	The Numerical
BitTorrent	5000
Facetime	5000
Gmail	5272
MySQL World Of Warcraft	5000 5000
Weibo	5001
Skype	5000
Virut	5035
Nsis-ay	5058
Zeus	5004

As shown in Table 2, we selected the 7 + 3 category in the USTC-TFC2016 dataset. Among them, there are seven different types of regular network traffic: BitTorrent, Facetime, Gmail, MySQL, Skype, Weibo, and World of Warcraft, and three different types of malicious network traffic: Zeus, Virut, and Nsis-ay. Table 3 shows the selected network traffic data types and quantity statistics.

We find that the effective content output in hexadecimal form in each PACP packet in the two datasets has obvious characteristic marks, and most of the effective bytes in the packet are between [50, 1480] bytes.

Therefore, for the data streams captured in the dataset described above, we store approximately 5000 pieces of data in hexadecimal format for each type of data stream. Each data flow collects 1480 bytes of packet load through the preprocessing model. If the payload length is less than 1480 bytes of traffic, we use complement 0 to expand it to 1480 bytes for storage.

4.1 Convolutional Neural Network Architecture

The design process of deep learning network model. Input the original flow data into the preprocessing module first, and then output data that can be directly used by the convolutional neural network via four steps: header information processing [33], key information extraction, and data reprocessing. The preprocessed training data is then fed into the deep learning network training mode [34], where the convolutional neural network model is trained via feature extraction, data simplification, category judgment, and feedback adjustment. Finally, the test data is fed into the test module, which contains the convolutional neural model that has been trained, and the system is evaluated based on the classification results.

4.2 HEXCNN-1D Model Structure Design

The one-dimensional convolutional neural network (HexCNN-1D) workflow is based on the network traffic recognition method. The model’s input data is the hexadecimal data obtained after preprocessing. Following the model’s training, the network traffic identification work is completed according to the various traffic categories.

To prevent overfitting, we added an attention mechanism and a batch normalization layer to the design of the HEXCNN-1D model. Normalization returns an uneven distribution to a normalized distribution. This allows processing data to be distributed in sensitive regions of the activation function, which speeds up model training and prevents gradient disappearance.

The flow of the HEXCNN-1D algorithm based on a convolutional neural network is shown in Fig. 1.

Considering the large amount and load of network traffic data to be processed, the traditional one-dimensional convolutional neural network model design cannot meet the requirement of lightweight to identify the types and categories of encrypted and malicious traffic with high precision. Therefore, we add normalized processing module and attention mechanism module to the model.

5.1 Batch Normalization Addition

When designing the convolutional neural network model, the Batch Normalized (BN) module is considered to be added to the normal convolutional neural network model [35]. Internal Covariate Shift [36] can cause problems such as slow convergence rates and gradient saturation, which the BN module can resolve.

$${y}_{i}^{\left(b\right)}={BN\left({x}_{i}\right)}^{\left(b\right)}={\gamma }\left(\frac{{x}_{i}^{\left(b\right)}-\mu \left({x}_{i}\right)}{\sqrt{\sigma {\left({x}_{i}\right)}^{2}+ϵ}}\right)+\beta$$

${{x}_{i}}^{\left(b\right)}$ represents the value of the $i-th$ input node of this layer when the $b-th$ sample of the current batch is input, ${x}_{i}$for $[{x}_{i}^{1}, {x}_{i}^{2}, {x}_{i}^{3},\dots ,{x}_{i}^{m}]$ a row vector, length of batch size m, $\mu$ and $\sigma$ for the mean and standard deviation, $ϵ$ division by zero to prevent the introduction of a minimum quantity (negligible), $\beta$ and $\gamma$ for the shift and scale parameters.

5.2 Attention Mechanism Addition

Due to the uneven distribution of data, the model will pay more attention to sufficient data, which will affect the final classification effect. As mentioned in this paper [37], CBAM is a lightweight general module, which can be applied in any CNN model and plays a non-negligible role in the application of GAB and CAB [38]. GAB and CAB can be used to learn the recognition features, so as to better solve the problem of low accuracy caused by uneven data distribution.

$${M}_{c\_a}=\left(ReLU\right(Conv2\left(GAP\right({M}_{G\_IN}\left)\right)\left)\right)\otimes {M}_{G-IN}, M\in {R}^{H\times W\times C}, {M}_{{G-IN}_{}}\in {R}^{H\times W\times {C}^{{\prime }}}, {C}^{{\prime }}=C/2$$

The channel attention feature ${M}_{c\_a}$ is calculated in Formula 2, where $H$ represents the height, $W$ represents the width, $C$ represents the number of channels, $ReLU$ represents the use of ReLU activation function, $GAP$ represents the global average pooling, ${M}_{G-IN}$ the use of 1×1 convolution layer to reduce the number of channels.

$${M}_{G-OUT}={M}_{c\_a}\otimes \left(ReLU\right(C\_G\left({M}_{c\_a}\right)\left)\right)$$

The number of channels required for each category is calculated by ${M}^{{\prime }},{M}^{{\prime }}\in {R}^{H\times W\times ck}$, Where $c$ is the number of channels needed to identify each category, and $k$ is the number of classes. half of the features are retained by ${M}^{{\prime }{\prime }}（{M}^{{\prime }{\prime }}={M}^{{\prime }}）$, and the Dropout function is removed to make prediction with all the features.

Formula 3 calculates the output of GAB, namely the spatial attention feature map ${M}_{G-OUT}$, ${M}_{G-OUT}={M}_{G-IN}$. ${M}_{G-OUT}$ is used to save the subtle and different information of each network traffic category in the detailed network traffic data, which is used as the input of the subsequent CAB.

$${S}_{i}=\frac{1}{n}\sum _{j=1}^{n}GMP\left({m}_{ij}^{{\prime }{\prime }}\right), i=\left\{\text{1,2},3,\dots ,k\right\}, S=\{{S}_{1},{S}_{2},{S}_{3},\dots ,{S}_{k}\}$$

Formula 4, ${S}_{i}$ represents the degree of significant response to the feature mapping of each category, $GMP$ represents the global maximum pooling, ${m}_{ij}^{{\prime }{\prime }}$ represents the JTH feature of class $i$ in ${M}^{{\prime }{\prime }}$ and the score $S$ of each category of network traffic is calculated by averaging the sum of ${M}^{{\prime }{\prime }}$ maximum pooling.

$${M}_{i\_avg}^{{\prime }}=\frac{1}{n}\sum _{j=1}^{n}{m}_{ij}^{{\prime }}, i=\left\{\text{1,2},3,\dots ,k\right\}$$

In Formula 5, ${M}_{i\_avg}^{{\prime }}$ represents the feature output mapping feature map of the class $i$, and ${m}_{ij}^{{\prime }}$ represents the reaction of the JTH feature of the class $i$ in ${M}^{{\prime }}$. The sum of the characteristic fractions of each class is calculated and averaged.

$${A}_{CAB}=\frac{1}{k}\sum _{i=1}^{k}{S}_{i}{M}_{i\_avg}^{{\prime }},{A}_{CAB}\in {R}^{H\times W\times 1}$$

In Formula 6, ${A}_{CAB}$is to multiply and average the calculated scores of each class and the semantic features of the class. It helps to differentiate areas of DR Grading.

$${M}_{C-OUT}={M}_{C-IN}\otimes {A}_{CAB}$$

Finally, as shown in Formula 7, ${M}_{C-OUT}$ is obtained by multiplying CAB and category attention ${A}_{CAB}$, enabling the model to obtain more accurate classification of different network traffic categories.

In this section, the network public dataset ISCX and USTC dataset are used for experiments. The test ratio of the training set was set at 7:3, and the sample set used in each experiment was described in detail.

6.1 Experimental Metrics Settings

In this research, four classification indices were utilized in the experiment: Accuracy, Precision, Recall, and F1-score. TP denotes the positive sample correctly predicted by the model, FN denotes the positive sample wrongly forecasted by the model, FN denotes the negative sample incorrectly predicted by the model, and TN denotes the negative sample correctly predicted by the model.

We utilize ablation experiment and the confusion matrix [39] to validate the detection of distinct data traffic categories and the experimental outcomes. Ablation experiments are commonly used on neural networks to learn about the network by deleting part of the network and studying its performance. The confusion matrix's function is to group the expected and actual results of all categories into the same table based on category. In this table, we can plainly observe the number of accurate and incorrect recognitions for each category.

6.2 Dataset Category Classification

The ISCX dataset contains traffic characteristics and raw traffic (in PCAP format). In our experiment, the experimental environment was divided into two categories (VPN and non-VPN), nine and eighteen.

The UTSC dataset uses the class 7 + 3 (seven non-malicious traffic and three malicious traffic) categories in the UTSC dataset to determine the model's ability to recognize malicious traffic. We have 1,000 of each, 10,000 samples in total. The experiment went through 50–60 iterations. The data requirements of the model are ensured.

7.1 Compared with HEXCNN-1D Methods

The following are the experimental findings of the HEXCNN-1D convolutional neural network model in two classifications, nine classifications, eighteen classifications, and malicious and non-malicious classifications:

The HEXCNN-1D model developed in this article uses two different exposed data sets, as shown in Fig. 2. the accuracy indices of all tests were kept above 98%.

As shown in Fig. 3, the above experimental results and data show that the HEXCNN-1D model designed in this paper has higher classification recognition accuracy and a more efficient classification effect.

Therefore, we suggest that the combination of a convolutional neural network and network traffic recognition can significantly improve the accuracy of network traffic classification technology and can be more successfully applied to network traffic detection.

Table 3

Malicious Traffic Identification by HEXCNN-1D
	Precision	Recall	F1-score
Zeus	99.8%	99.1%	99.3%
Virut	99.1%	98.4%	98.6%
Nsis-ay	98.1%	98.3%	97.9%

As shown in Table 3, the USTC-TFC data set shows that the HEXCNN-1D model has more than 98% identification accuracy against malicious traffic such as Zeus, Virut, and Nsis-ay. This shows that the HEXCNN-1D model established in this paper has the ability to detect malicious traffic.

Table 4

Comparison with Experimental Results of Different Models
	Non-VPN		VPN
	Precision	Recall	Precision	Recall
Deep Packet [32]	70.6%	70.6%	-	85.5%
C4.5 [17]	84%	87.6%	89%	85.5%
1D-CNN [33]	95.6%	95.6%	95.6%	95.6%
NIN(large) [24]	97.5%	97.4%	97.9%	97.9%
CNN-2D	98.7%	98.6%	98.6%	97.7%
HEXCNN-1D	98.8%	98.7%	98.8%	98.7%

Deep learning HEXCNN-1D convolutional neural network classification model was trained to extract different label features. Four independent scenario tests were set up to collect experimental data of the HEXCNN-1D model and compare it with the classical machine learning model. As can be seen from Table 4, the model proposed in this paper is superior to other network machine learning models in identifying VPN and non-VPN traffic.

7.2 Ablation Experiments

In order to evaluate the effectiveness of the model by adding normalized processing and attentional mechanisms, we conducted ablation experiments on HEXCNN-1D. As shown in Table 5, the model is mainly processed by one-dimensional convolutional neural network, followed by normalization processing and attention mechanism modules. First, a single one-dimensional convolutional neural network was tested to calculate the Accuracy, Precision, Recall and F1-score of the model. Then, the accuracy of F1-score and other indicators of the model after the addition of normalized processing were increased by about 3%. Finally, CAB and GAB were added to the basic model, and the overall index increased by about 2%, indicating that the attention module improved the efficiency of the model to identify network traffic categories.

Table 5

Comparison of Ablation Experiments
Model	Accuracy	Precision	Recall	F1-score
CNN-1D	90.1%	91.2%	92.7%	92.3%
CNN-1D + BN	95.2%	94.3%	94.6%	94.5%
CNN-1D + CAB + GAB	96.6%	96.7%	96.4%	96.6%
Our Model	98.9%	98.8%	98.7%	98.7%

7.3 Confusion Matrix Validation Experiment Results

We used the confusion matrix shown in Fig. 7 to verify the experimental data and the accuracy of the classification of the experimental results.

The experimental results of the confusion matrix verify that the accuracy of the results is very high. The experimental results show that the HEXCNN-1D classification model adopted in this paper has high accuracy in four experimental scenarios, and has achieved excellent recognition effect in encrypted traffic and malicious traffic identification.

In this paper, convolutional neural network model is designed to study network traffic recognition. In the data preprocessing stage, the influence of redundant information is ignored. The data preprocessing method was paired with the convolutional neural network model designed by HEXCNN-1D. Our model can identify traditional traffic data and vpn encapsulated traffic with an accuracy of 99%. The detection accuracy of malicious traffic data is about 98%. We found that in the detection of malicious network traffic, such as Zeus, Virut and NISs-Ay, the accuracy of network traffic identification reached more than 98%. In the future, we will study the robustness of these models and the performance migration of models under different flow modes.

Acknowledgments

The author would like to thank the anonymous reviewers for their valuable comments and the funding from Shandong Provincial Natural Science Foundation, Jinan Research Leader Workshop Project and Qilu University of Technology (Shandong Academy of Sciences) International Cooperation Pilot Project of Science, Education and Industry Integration Innovation.

Funding

This work was supported by the Natural Science Foundation of Shandong Province (No. ZR2019LZH013) and the Natural Science Foundation of Shandong Province (No. ZR2020LZH010). Thanks to the Jinan Scientific Research Leader Studio Project under Grant (No. 2021GXRC091). Thanks to The Pilot International Cooperation Project for Integrated Innovation of Science, Education and Industry of Qilu University of Technology (Shandong Academy of Sciences) under Grant No.2022GH007.

Contributions

All authors have participated in conception and design, or analysis and interpretation of this paper. All authors read and approved the final manuscript.

Ethics Declarations

Ethics Approval and Consent to Participate

No ethical approval is required, and the authors express their consent to participate in the paper.

Consent for Publication

Authors provide consent for publication.

Conflicts Interest

The authors have no relevant financial or non-financial interests to disclose.

Data Availability

The datasets analysed during the current study are available in the UNB and github repository, respectively: VPN-NonVPN Dataset (ISCXVPN2016) is: http://www.unb.ca/cic/datasets/vpn.html. The USTC – TFC 2016 dataset is: https://github.com/echowei/DeepTraffic. All other data are available from the authors upon reasonable request.

Availability of Data and Materials

The corresponding author may provide the supporting data on request.

H. Ahmed, A. Alsadoon, P. W. C. Prasad, N. Costadopoulos, L. S. Hoe and A. Elchoemi, "Next generation cyber security solution for an eHealth organization," 2017 5th International Conference on Information and Communication Technology (ICoIC7), 2017, pp. 1-5, doi: 10.1109/ICoICT.2017.807 4723.
S. I. Popoola, R. Ande, B. Adebisi, G. Gui, M. Hammoudeh and O. Jogunola, "Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices," in IEEE Internet of Things Journal, vol. 9, no. 5, pp. 3930-3944, 1 March1, 2022, doi: 10.1109/JIOT.2021.3100755.
J. Ning et al., "Malware Traffic Classification Using Domain Adaptation and Ladder Network for Secure Industrial Internet of Things," in IEEE Internet of Things Journal, vol. 9, no. 18, pp. 17058-17069, 15 Sept.15, 2022, doi: 10.1109/JIOT.2021.3131981.
M. Kumar, P. Mukherjee, K. Verma, S. Verma and D. B. Rawat, "Improved Deep Convolutional Neural Network Based Malicious Node Detection and Energy-Efficient Data Transmission in Wireless Sensor Networks," in IEEE Transactions on Network Science and Engineering, vol. 9, no. 5, pp. 3272-3281, 1 Sept.-Oct. 2022, doi: 10.1109/TNSE.2021.3098011.
Q. Sun and Y. Shi, "Model Predictive Control as a Secure Service for Cyber–Physical Systems: A Cloud-Edge Framework," in IEEE Internet of Things Journal, vol. 9, no. 22, pp. 22194-22203, 15 Nov.15, 2022, doi: 10.1109/JIOT.2021.3091981.
K. Yu, L. -z. Tan, X. -j. Wu and Z. -y. Gai, "Machine Learning Driven Network Routing," 2019 6th International Conference on Systems and Informatics (ICSAI), 2019, pp. 705-712, doi: 10.1109/ICSAI 48974.2019.9010507.
B. Yang and D. Liu, "Research on Network Traffic Identification based on Machine Learning and Deep Packet Inspection," 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference (ITNEC), 2019, pp. 1887-1891, doi: 10.1109/ITNEC.2019.8729153.
S. Dong, P. Wang, and K. Abbas, “A survey on deep learning and its applications,” Computer Science Review, vol. 40, p. 100379, 2021, https://doi.org/10.1016/j.cosrev.2021.100379.
M. Li, D. Han, X. Yin, H. Liu, D. Li, Design and implementation of an anomaly network traffic detection model integrating temporal and spatial features, Security and Communication Networks 2021, https://doi.org/10.1155/2021/7045823.
A. Karpathy, G. Toderici, S. Shetty, T. Leung, R. Sukthankar and L. Fei-Fei, "Large-Scale Video Classification with Convolutional Neural Networks," 2014 IEEE Conference on Computer Vision and Pattern Recognition, 2014, pp. 1725-1732, doi: 10.1109/CVPR.2014.223.
J. Zhao, X. Jing, Z. Yan, W. Pedrycz, Network traffic classification for data fusion: A survey, Information Fusion. pp. 22–47, 2021, https://doi.org/10.1016/j.inffus.2021.02.009
J. Zhang, Y. Xiang, Y. Wang, W. Zhou, Y. Xiang and Y. Guan, "Network Traffic Classification Using Correlation Information," in IEEE Transactions on Parallel and Distributed Systems, vol. 24, no. 1, pp. 104-117, Jan. 2013, doi: 10.1109/TPDS.2012.98.
Velan, Petr, et al. "A survey of methods for encrypted traffic classification and analysis." International Journal of Network Management. pp. 355-374. 2015, https://doi.org/10.1002/nem.1901.
Hu Y, Chiu D M, Lui J C S. Application identification based on network behavioral profiles[C]//2008 16th interntional workshop on quality of service. IEEE, pp. 219-228, doi: 10.1109/IWQOS.2008.31.
LiJuan Zhang, DongMing Li, Jing Shi and JunNan Wang, "P2P-based weighted behavioral characteristics of deep packet inspection algorithm," 2010 International Conference on Computer, Mechatronics, Control and Electronic Engineering, 2010, pp. 468-470, doi: 10.1109/CMCE.201 0.5610457.
F. Risso, M. Baldi, O. Morandi, A. Baldini and P. Monclus, "Lightweight, Payload-Based Traffic Classification: An Experimental Evaluation," 2008 IEEE International Conference on Communications, 2008, pp. 5869-5875, doi: 10.1109/ICC.2008.1097.
Cao Z, Xiong G, Zhao Y, et al. A survey on encrypted traffic classification[C]//International Conference on Applications and Techniques in Information Security. Springer, Berlin, Heidelberg, pp. 73-81, 2014, https://doi.org/10.1007/978-3-662-45670-5_8.
S. Dong, “Online encrypted skype identification based on an updating mechanism,” ArXiv, vol. abs/2203.12141, 2022, doi: 10.48550/arXiv.2203.12141.
Dong, S., Xia, Y. & Peng, T. Traffic identification model based on generative adversarial deep convolutional network. Ann. Telecommun. 77, 573–587, 2022, https://doi.org/10.1007/s12243-021-00876-6.
Dong, S., Li, R. Traffic identification method based on multiple probabilistic neural network model. Neural Comput & Applic 31, 473–487 2019, https://doi.org/10.1007/s00521-017-3081-x.
A. Priya, S. Nandi and R. S. Goswami, "An Analysis of real-time network traffic for identification of browser and application of user using clustering algorithm," 2018 International Conference on Advances in Computing, Communication Control and Networking (ICACCCN), 2018, pp. 441-445, doi: 10.1109/ICACCCN.2018.8748706.
D. Wang, L. Zhang, Zhenlong Yuan, Y. Xue and Y. Dong, "Characterizing Application Behaviors for classifying P2P traffic," 2014 International Conference on Computing, Networking and Communications (ICNC), 2014, pp. 21-25, doi: 10.1109/ICCNC.2014.6785298.
Coull S E, Dyer K P. Traffic analysis of encrypted messaging services: Apple imessage and beyond[J]. ACM SIGCOMM Computer Communication Review, pp. 5-11, 2014, https://doi.org/10.1145/267704 6.2677048.
Di Mauro M, Longo M. Revealing encrypted WebRTC traffic via machine learning tools[C]//2015 12th International Joint Conference on e-Business and Telecommunications (ICETE). IEEE, pp. 259-266, 2015, https://doi.org/10.5220/0005542202590266.
S. Dong, Y. Xia, and T. Peng, “Network abnormal traffic detection model based on semisupervised deep reinforcement learning,” IEEE Transactions on Network and Service Management, vol. 18, no. 4, pp. 4197–4212, 2021, doi: 10.1109/TNSM.2021.3120804.
S. Dong, “Multi class svm algorithm with active learning for network traffic classification,” Expert Systems with Applications, vol. 176, p. 114885, 2021, https://doi.org/10.1016/j.eswa.2021.114885.
Wang W, Zhu M, Wang J, et al. End-to-end encrypted traffic classification with one-dimensional convolution neural networks[C]//2017 IEEE international conference on intelligence and security informatics (ISI). IEEE, pp. 43-48, 2017, doi: 10.1109/ISI.2017.8004872.
Wang W, Zhu M, Zeng X, et al. Malware traffic classification using convolutional neural network for representation learning[C]//2017 International conference on information networking (ICOIN). 2017, pp. 712-717, doi: 10.1109/ICOIN.2017.7899588.
Lotfollahi M, Jafari Siavoshani M, Shirali Hossein Zade R, et al. Deep packet: A novel approach for encrypted traffic classification using deep learning[J]. Soft Computing, pp. 1999-2012, 2020, https://doi.org/10.1007/s00500-019-04030-2.
Zou Z, Ge J, Zheng H, et al. Encrypted traffic classification with a convolutional long short-term memory neural network[C]//2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS). 2018, pp. 329-334, doi: 10.1109/HPCC/SmartCity/DSS.2018.00074.
Z. Bu, B. Zhou, P. Cheng, K. Zhang and Z. -H. Ling, "Encrypted Network Traffic Classification Using Deep and Parallel Network-in-Network Models," in IEEE Access, vol. 8, pp. 132950-132959, 2020, doi: 10.1109/ACCESS.2020.3010637.
H. Zhou, Y. Wang, X. Lei and Y. Liu, "A Method of Improved CNN Traffic Classification," 2017 13th International Conference on Computational Intelligence and Security (CIS), 2017, pp. 177-181, doi: 10.1109/CIS.2017.00046.
Samanta R K, Sanyal G, Bhattacharjee P. Study and analysis of cellular wireless networks with multiclass traffic[C]//2009 IEEE International Advance Computing Conference. IEEE, pp. 1081-1086.
, 2009, doi: 10.1109/IADCC.2009.4809164.
LiJuan Zhou, ZhiTong Li and Bin Liu, "P2P traffic identification by TCP flow analysis," 2006 International Workshop on Networking, Architecture, and Storages (IWNAS'06), 2006, pp. 2 pp.-, doi: 10.1109/IWNAS.2006.36.
Kalayeh M M, Shah M. Training faster by separating modes of variation in batch-normalized models[J]. IEEE transactions on pattern analysis and machine intelligence, pp. 1483-1500, 2019, doi: 10.1109/TPAMI.2019.2895781.
M. Awais, M. T. Bin Iqbal and S. -H. Bae, "Revisiting Internal Covariate Shift for Batch Normalization," in IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 11, pp. 5082-5092, Nov. 2021, doi: 10.1109/TNNLS.2020.3026784.
S. Woo, J. Park, J.-Y. Lee, and I. S. Kweon, “Cbam: Convolutional block attention module,” in Computer Vision – ECCV 2018 (V. Ferrari, M.Hebert, C. Sminchisescu, and Y. Weiss, eds.), (Cham), pp. 3–19, Springer International Publishing, 2018, https://doi.org/10.1007/978-3-030-01234-2_1.
A. He, T. Li, N. Li, K. Wang and H. Fu, "CABNet: Category Attention Block for Imbalanced Diabetic Retinopathy Grading," in IEEE Transactions on Medical Imaging, vol. 40, no. 1, pp. 143-153, Jan. 2021, doi: 10.1109/TMI.2020.3023463.
J. L. Garcia-Balboa, M. V. Alba-Fernandez, F. J. Ariza-López and J. Rodriguez-Avi, "Homogeneity Test for Confusion Matrices: A Method and an Example," IGARSS 2018 - 2018 IEEE International Geoscience and Remote Sensing Symposium, 2018, pp. 1203-1205, doi: 10.1109/IGARSS.2018.851 7924.

No competing interests reported.

Download PDF

Journal Publication

published 10 Apr, 2023

Read the published version in Journal of Cloud Computing →

Editorial decision: Major revision
07 Feb, 2023
Reviews received at journal
05 Feb, 2023
Reviewers agreed at journal
04 Feb, 2023
Reviewers agreed at journal
03 Feb, 2023
Reviewers invited by journal
03 Feb, 2023
Editor assigned by journal
29 Jan, 2023
Submission checks completed at journal
26 Jan, 2023
First submitted to journal
19 Jan, 2023

You are reading this latest preprint version

Identification of Encrypted and Malicious Network Traffic Based on One-Dimensional Convolutional Neural Network

Status:

Journal Publication

Version 1

Abstract

Figures

1 Introduction

2 Related Work

3 Network Traffic Data Preprocessing

4 Network Traffic Identification Framework

4.1 Convolutional Neural Network Architecture

4.2 HEXCNN-1D Model Structure Design

5 Batch Normalization And Attention Mechanism Addition

5.1 Batch Normalization Addition

5.2 Attention Mechanism Addition

6 Experimental Data And Index Setting

6.1 Experimental Metrics Settings

6.2 Dataset Category Classification

7 Experimental Results Of Network Traffic Identification

7.1 Compared with HEXCNN-1D Methods

7.2 Ablation Experiments

7.3 Confusion Matrix Validation Experiment Results

8 Conclusion

Declarations

Acknowledgments

Funding

Contributions

Ethics Declarations

Ethics Approval and Consent to Participate

Consent for Publication

Conflicts Interest

Data Availability

Availability of Data and Materials

References

Additional Declarations

Status:

Journal Publication

Version 1