FullView: Using Bidirectional Group Sequences to Achieve Accurate Encrypted Traffic Classification
摘要
Traffic classification plays an essential role in ensuring Quality of Service and network security. Recently, the development of traffic encryption technologies has rendered traditional methods based on ports and deep packet inspection ineffective. In recent years, deep learning-based solutions have been successful in classifying encrypted traffic by using time series, such as packet length sequence and timestamp sequence. However, there are still two shortcomings in existing studies. Firstly, the local and global timing features in the time series are not fully utilized. Secondly, the relationship between incoming and outgoing flows in a bidirectional flow (Bi-Flow) is not deeply explored. To address the shortcomings, we propose a novel scheme named FullView. It contains a traffic representation method called Bidirectional Grouping Matrices (BGM) and a two-path classification model. To fully utilize the local and global timing features, the packet length sequences are divided into groups. Two different encoders are designed to extract intra-group features and cross-group features respectively. To explore the interaction between outgoing and incoming flows, bidirectional matrices are designed to represent Bi-Flows. In the classification model, there are two separate paths to extract timing features from incoming and outgoing views and a fusion module to combine all features. To validate FullView, we conduct comparative experiments on three datasets. The results demonstrate that FullView achieves outstanding performance and outperforms the state-of-the-art schemes.