| With the rapid development of network technology,the number of people using the network and the scale of network applications have gradually become larger,which has led to the emergence of various network attacks,such as the emergence of worms and computer ransomware viruses,which bring great threats to people’s lives and work.Network traffic classification techniques can classify network traffic in a multi-scale manner to detect malicious traffic or attack traffic among them.Most of the early network traffic classification techniques were based on port number identification and deep packet inspection techniques,but with the development of networks,the multiplexing of port numbers in networks and the generation of encrypted traffic make such traffic classification methods have certain limitations.In recent years,with the continuous development of deep learning technology,the application scenarios of deep learning are increasingly broad,for example,in natural language processing,computer vision,medical image processing and so on.This has brought new inspiration to traffic classification research.In this paper,we study and explore the way to achieve end-to-end traffic classification by automatic learning of traffic features without creating feature sets manually on top of deep learning.The main work of this paper is as follows:First To address the problem of insufficient traffic feature extraction in the current deep learning-based malicious traffic classification research,this paper proposes a malicious traffic classification model based on deep residual shrinkage network.Compared with other deep learning models,this model learns the important feature information through soft thresholding and an attention mechanism,while suppressing the interference of irrelevant information,in order to improve the efficiency of extracting traffic features and finally improve the accuracy of classification.The method firstly performs pre-processing steps such as slicing,deredundancy,anonymization,uniform length and conversion to grayscale map on the Pcap traffic files in the publicly available traffic dataset,and inputs the pre-processed traffic dataset into the built model for training,and finally completes the classification.In this paper,ten-class and twenty-classification experiments are conducted for malicious traffic and normal traffic,and the experimental results show that the model achieves 96.3% accuracy in the twentyclassification experiments with more complex classification tasks,which achieves good results.Finally,in order to better demonstrate the advantages for feature extraction,this paper also compares with the ResNet model in the twenty classification task,and all the metrics are better than the ResNet model,which shows that the classification accuracy can be improved by adding soft thresholds and attention mechanisms,further illustrating the effectiveness of the model.Second To address the problem of insufficient extraction of traffic timing features in the current deep learning-based encrypted traffic classification task,this paper proposes a CNNGRU encrypted traffic classification model based on the attention mechanism.Compared with other models,the main role of this model is to learn more temporal features inside the traffic,and in the same way as the traffic preprocessing mentioned above,this model trains as well as classifies the preprocessed dataset.In this paper,we choose the session all layer traffic segmentation approach and conduct a comparison experiment with the two-dimensional CNN model for the twelve classification tasks of encrypted traffic datasets.The experimental results show that a high traffic classification accuracy can be achieved by using the session all layer segmentation approach,and the accuracy of this model is improved by 11% compared to the two-dimensional CNN model.To further demonstrate that this model can improve the classification of encrypted traffic with the learning of traffic timing features,this paper also conducts a comparative analysis with the CNN-RNN model,and the results show that the accuracy of this model is improved by 4.2% compared with the CNN-RNN model. |
