Research On Network Traffic Classification Based On Convolutional Neural Network

The network traffic classification is one of the basic works in the field of the network management and the network security.It refers to the establishment of a mapping relationship between the network traffic data and the application types according to the features.On the one hand,in order to enhance users' surfing experience,network managers hope to provide high-priority communication guarantee for applications with high real-time requirements,and reduce the loss of the relevant packets as far as possible.On the other hand,network managers need to timely find and block the intrusion traffic.According to the different theories,the network traffic classification can be divided into four methods:port matching,payload matching,machine learning and deep learning.Since the first three methods are difficult to deal with the complex and changeable network environment,deep learning has become a new trend to solve the problem.In this paper,we mainly research on the application of the convolutional neural network in the traffic classification,and conduct the experiments on the malicious network traffic and the encrypted network traffic.Firstly,we preprocess the original data of the network traffic and design four kinds of traffic segmentation methods.After the steps of segmentation,cleaning and conversion,the network traffic is converted into the standard input of the convolutional neural network.Then we design a two-dimensional convolutional neural network with few hidden layers,and apply it to the malicious traffic classification in different scenes.After a series of experiments,we have determined the best traffic segmentation method suitable for the malicious traffic,and have proved that the application of the two-dimensional convolutional neural network in malicious traffic classification is in good condition.Finally,based on the research of the malicious traffic classification,the convolutional neural network is applied to the classification of the encrypted traffic,and the convolutional neural network is adjusted to achieve a higher classification accuracy in view of the shortcoming that the load matching method cannot identify the encrypted traffic and the inconvenience that the machine learning method needs to manually select features.On the one hand,considering the temporal correlation of traffic data,the two-dimensional convolutional neural network is adjusted to one-dimensional under the condition of keeping the quantity of the hidden layers unchanged.The result shows that the classification performance of the model has been improved to some extent.On the other hand,considering the advantages of the deep convolutional neural network in the feature extraction,WideResNet is applied to the network traffic classification for the first time.The result shows that the classification F1 value of the encryption traffic in ISCX VPN-nonVPN dataset is increased to 99.8%,which surpasses the records by SAE and LSTM,and meets the requirements of the practical application.