FLOWGAN:Research On Key Technology Of Encrypted Traffic Identification Based On Generative Adversarial Network

The rapid popularity of mobile devices has greatly changed the access methods of various network services,resulting in an explosive growth of mobile application traffic.In the past few decades,mobile service traffic classification has attracted a lot of interests of researchers in the areas of mobile network management and security.However,mobile traffic classification faces many challenges since more and more mobile services adopt encryption.Although the classic machine learning methods can solve many problems that the port and payload based methods suffered from,it still has some limitations,such as time-consuming and domain-expert driven handcrafted features engineering.Deep learning has a good ability to learn features automatically.It undoubtedly becomes an ideal method for mobile service traffic classification,especially encrypted traffic classification.However,there are still some limitations.One of them is the imbalance of network traffic data.The imbalance of data will cause classification models to misidentify similar types of applications,which will affect the classification results.Furthermore,it is very difficult to label encrypted traffic,but unmarked encrypted traffic is very easy to obtain.Based on this,this paper proposes a deep learning method called Flow GAN to solve the problem of class imbalance in encrypted traffic classification.Flow GAN,as a genre of generative adversarial networks(GAN),takes advantage of GAN data augmentation to supplement small samples;At the same time,by using the SGAN,a small number of labeled samples and a large number of unlabeled samples can be used for classification.A variety of deep learning classification models such as MLP,CNN,SAE,etc.are used to classify the balanced encrypted traffic to form an application label.The main work of this article is as follows:(1)This paper focuses on the problem of low recognition rate of small samples in the case of imbalanced data set,and proposes the use of GAN to augent encrypted data traffic to solve the problem of collecting encrypted traffic data.(2)Because labeled samples are difficult to obtain,this paper optimizes SGAN's network structure and parameters to combine it with semi-supervised learning.Using a small number of labeled samples and a large number of unlabeled samples,a discriminator is trained to perform classification experiments.(3)Use three classification models based on MLP,CNN and SAE to perform classificationverification on data sets using different data balance methods(oversampling balance method,SMOTE balance method and GAN-based balance method)to verify the flow of FLOWGAN.performance.The experimental results show that using the ISCX data set,SGAN method for semi-supervised learning,compared with CNN method,when the number of labeled samples is small,the accuracy is significantly improved.Using MLP as the classification method,the classification result of the small sample application is significantly improved.The experimental results based on the GAN method are improved by 0-30% respectively.The three small sample applications of aim?chat,facebook and icq also have 0-3% improvement when using CNN and SAE classification methods.