Deep Learning Based Network Traffic Classification

With the rapid development of the Internet,network traffic is increasing day by day,which poses a challenge to network management and application.Network traffic classification is an important prerequisite for network operation management,traffic intrusion detection and user behavior analysis.Effective method of resource management can improve efficiency and reduce costs.At present,most of the network traffic classification technologies are based on traditional machine learning methods,and the classification accuracy is highly dependent on the design of traffic feature set,while the selection of effective feature set requires rich feature engineering experience.In recent years,deep learning has been widely used in computer vision,natural language processing and speech recognition.The strong learning ability of input samples makes deep learning achieve good results in the field of traffic classification.However,the deep learning framework has strict requirements on the format and size of input data,so it is necessary to preprocess the flow first.At present,most of the flow preprocessing processes have some deficiencies such as redundant input data and too large size,which ultimately leads to too long training time of the deep learning model and too much model calculation.This paper mainly studies the network traffic classification method based on CNN and LSTM model.The main work is as follows:In view of the shortcomings of the existing deep learn-based framework model,which has a long training time and a large amount of model computation,a method of traffic classification based on one-dimensional CNN is proposed to realize the packet level encryption network traffic classification.This method firstly removes the redundancy in the traffic data and the information that may affect the final classification results by a series of preprocessing of the original network traffic in pcap format such as segmentation,deredundancy,anonymization,uniform length,image conversion and data set generation.Then,the one-dimensional CNN neural network model is constructed,and the pre-processed traffic data set is used to train the constructed model,and finally the encrypted network traffic classification is completed.Compared with the traditional method based on machine learning,this method does not need to manually select the feature set,and automatically learns the characteristics of preprocessed traffic data through the neural network to complete the traffic classification.Meanwhile,the process of traffic preprocessing removes the redundant information in the original traffic data.Experimental results show that the accuracy,precision,recall rate and F1 value of this method are all higher than 98.7% in the experiment of 12 kinds of encrypted traffic classification on the public network traffic data set.Compared with other methods of traffic classification based on convolutional neural network,the model has fewer parameters and shorter training time.To solve the problem that the general deep learning model is not sensitive to the internal temporal characteristics of network traffic,a method of malicious traffic classification based on Attention mechanism is proposed at the packet level.Compared with the traffic classification method based on convolutional neural network,this method has a better learning ability on the internal timing and structure of traffic,and can selectively learn the key information such as port number and packet length in the pre-processed traffic more comprehensively,so as to achieve better traffic classification.The experimental results show that the flow of encryption in public data sets and malicious traffic data sets,the model in the classification of 12 kinds of encryption flow experiment,the average classification accuracy and recall rate values are higher than 99.6%,and F1 in 20 contains malicious traffic classification experiment,the average classification accuracy and recall rate and F1 values are higher than 99.3%,compared with other existing methods,under the condition of guarantee the performance of classification model parameters greatly reduced.