基于卷积神经网络的加密流量分类方法

doi:10.11959/j.issn.2096-109x.2022077

摘要/Abstract

摘要：

针对传统加密网络流量分类方法准确率较低、泛用性不强、易侵犯隐私等问题，提出了一种基于卷积神经网络的加密流量分类方法，避免依赖原始流量数据，防止过度拟合特定应用程序的字节结构。针对网络流量的数据包大小和到达时间信息，设计了一种将原始流量转换为二维图片的方法，直方图中每个单元格代表到达相应时间间隔的具有相应大小数据包的数量，不依赖数据包有效载荷，避免了侵犯隐私；针对LeNet-5卷积神经网络模型进行了优化以提高分类精度，嵌入Inception模块进行多维特征提取并进行特征融合，使用1*1卷积来控制输出的特征维度；使用平均池化层和卷积层替代全连接层，提高计算速度且避免过拟合；使用对象检测任务中的滑动窗口方法，将每个网络单向流划分为大小相等的块，确保单个会话中训练集中的块和测试集中的块没有重叠，扩充了数据集样本。在ISCX数据集上的分类实验结果显示，针对应用流量分类任务，准确率达到了 95%以上。对比实验结果表明，训练集和测试集类型不同时，传统分类方法出现了显著的精度下降乃至失效，而所提方法的准确率依然达到了89.2%，证明了所提方法普适于加密流量与非加密流量。进行的所有实验均基于不平衡数据集，如果对数据集进行平衡化处理，准确率可能会进一步提高。

关键词: 加密流量, 卷积神经网络, 深度学习, 特征融合, 模型优化

Abstract:

Aiming at the problems of low accuracy, weak generality, and easy privacy violation of traditional encrypted network traffic classification methods, an encrypted traffic classification method based on convolutional neural network was proposed, which avoided relying on original traffic data and prevented overfitting of specific byte structure of the application.According to the data packet size and arrival time information of network traffic, a method to convert the original traffic into a two-dimensional picture was designed.Each cell in the histogram represented the number of packets with corresponding size that arrive at the corresponding time interval, avoiding reliance on packet payloads and privacy violations.The LeNet-5 convolutional neural network model was optimized to improve the classification accuracy.The inception module was embedded for multi-dimensional feature extraction and feature fusion.And the 1*1 convolution was used to control the feature dimension of the output.Besides, the average pooling layer and the convolutional layer were used to replace the fully connected layer to increase the calculation speed and avoid overfitting.The sliding window method was used in the object detection task, and each network unidirectional flow was divided into equal-sized blocks, ensuring that the blocks in the training set and the blocks in the test set in a single session do not overlap and expanding the dataset samples.The classification experiment results on the ISCX dataset show that for the application traffic classification task, the average accuracy rate reaches more than 95%.The comparative experimental results show that the traditional classification method has a significant decrease in accuracy or even fails when the types of training set and test set are different.However, the accuracy rate of the proposed method still reaches 89.2%, which proves that the method is universally suitable for encrypted traffic and non-encrypted traffic.All experiments are based on imbalanced datasets, and the experimental results may be further improved if balanced processing is performed.

Key words: encrypted traffic, convolution neural network, deep learning, feature fusion, model optimization

中图分类号:

TP393

谢绒娜, 马铸鸿, 李宗俞, 田野. 基于卷积神经网络的加密流量分类方法[J]. 网络与信息安全学报, 2022, 8(6): 84-91.

Rongna XIE, Zhuhong MA, Zongyu LI, Ye TIAN. Encrypted traffic classification method based on convolutional neural network[J]. Chinese Journal of Network and Information Security, 2022, 8(6): 84-91.

图/表 8

图1

图2

图3

表1

图4

表2

表3

表4

参考文献 17

[1]	李艳霞, 柴毅, 胡友强 ,等. 不平衡数据分类方法综述[J]. 控制与决策, 2019,34(4): 673-688.
	LI Y X , CAI Y , HU Y Q ,et al. A summary of the classification methods of unbalanced data[J]. Control and decision-making, 2019,34(4): 673-688.
[2]	王攀, 陈雪娇 . 基于堆栈式自动编码器的加密流量识别方法[J]. 计算机工程, 2018,44(11): 140-147.
	WANG P , CHEN X J . Encrypted traffic identification method based on stack automatic encoder[J]. Computer Engineering, 2018,44(11): 140-147.
[3]	FINSTERBUSCH M , RICHTER C , ROCHA E ,et al. A survey of payload-based traffic classification approaches[J]. IEEE Communications Surveys ＆ Tutorials, 2014,16(2): 1135-1156.
[4]	DAINOTTI A , PESCAPE A , CLAFFY K C . Issues and future directions in traffic classification[J]. Network IEEE, 2012,26(1): 35-40.
[5]	骆子铭, 许书彬, 刘晓东 . 基于机器学习的TLS恶意加密流量检测方案[J]. 网络与信息安全学报, 2020,6(1): 77-83.
	LUO Z M , XU S B , LIU X D . TLS malicious encryption traffic detection scheme based on machinelearning[J]. Journal of Network and Information Security, 2020,6(1): 77-83.
[6]	REZAEI S , LIU X . Deep learning for encrypted traffic classification:an overview[J]. IEEE Communications Magazine, 2019,57(5): 76-81.
[7]	WEI W , MING Z , WANG J ,et al. End-to-end encrypted traffic classification with one-dimensional convolution neural networks[C]// 2017 IEEE International Conference on Intelligence and Security Informatics (ISI). 2017: 43-48.
[8]	XIAO X , XIAO W , LI R ,et al. EBSNN:extended byte segment neural network for network traffic classification[J]. IEEE Transactions on Dependable and Secure Computing, 2021,10(1).
[9]	朱文斌, 马秀丽 . 多种构图方式下的加密流量分类[J]. 电子测量技术, 2021,44(12): 87-92.
	ZHU W B , MA X l . Classification of encrypted traffic under multiple composition methods[J]. Electronic Measurement Technology, 2021,44(12): 87-92.
[10]	REZAEI S , LIU X . How to achieve high classification accuracy with just a few labels:a semi-supervised approach using sampled packets[J]. arXiv preprint arXiv:1812.09761, 2018.
[11]	LOTFOLLAHI M , JAFARI SIAVOSHANI M , SHIRALI HOSSEIN ZADE R ,et al. Deep packet:a novel approach for encrypted traffic classification using deep learning[J]. Soft Computing, 2020,24(3): 1999-2012.
[12]	CHEN Z , HE K , LI J ,et al. Seq2img:a sequence-to-image based approach towards ip traffic classification using convolutional neural networks[C]// 2017 IEEE International Conference on Big Data. 2017: 1271-1276.
[13]	ERTAM F , AVCI E . A new approach for internet traffic classification:GA-WK-ELM[J]. Measurement, 2017,95: 135-142.
[14]	LOPEZ-MARTIN M , CARRO B , SANCHEZ-ESGUEVILLAS A , ,et al. Network traffic classifier with convolutional and recurrent neural networks for internet of things[J]. IEEE Access, 2017,(99): 1-1.
[15]	WANG W , ZHU M , ZENG X ,et al. Malware traffic classification using convolutional neural network for representation learning[C]// 2017 International conference on information networking (ICOIN). 2017: 712-717.
[16]	DRAPER-GIL G , LASHKARI A H , MAMUN M S I ,et al. Characterization of encrypted and VPN traffic using time-related[C]// Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP). 2016: 407-414.
[17]	SZEGEDY C , TOSHEV A , ERHAN D . Deep neural networks for object detection[J]. Advances in Neural Information Processing Systems, 2013:26.

服务类别	样本数量	服务类别	样本数量
File	2 192	VPN_File	2 093
Browsing	6 182	VPN_Browsing	4 895
Voip	6 317	VPN_Voip	5 876
Streaming	1 593	VPN_Steaming	612
Chat	1 241	VPN_Chat	964

类别	添加Inception模块CNN准确率	普通CNN准确率
File	93.4%	91.6%
Browsing	95.2%	93.7%
VoIP	99.8%	98.2%
Streaming	99.6%	95.4%
Chat	97.2%	92.4%

类别		准确率
类别		非VPN	VPN
File	NonVPN	98.5	93.2
	VPN	91.1	99.4
Browsing	NonVPN	97.8	97.3
	VPN	89.9	98.4
VoIP	NonVPN	99.4	99.6
	VPN	96.1	98.7
Streaming	NonVPN	99.1	98.6
	VPN	91.3	99.3
Chat	NonVPN	96.2	79.4
	VPN	81.7	99.2

模型类别	训练集与测试集类型相同时是否可以识别流量	训练集与测试集类型不同时是否可以识别流量	训练集与测试集类型相同时的识别准确率	训练集与测试集类型不同时的识别准确率
本文模型	是	是	97.6%	89.2%
端到端分类模型	是	否	96.8%	53.1%
基于多种构图的分类模型	是	否	95.4%	55.8%