Encrypted Traffic Classification For Zero-shot Generalization

Today,a large number of network applications are emerging,offering a wide range of services and functions to users,but also leading to a more diverse and complex network environment.In this situation,network measurement and management require more granular and effective traffic classification methods,and with the broad application of encryption technology in data transmission,the task of encrypted traffic classification has become increasingly challenging.Recent approaches have mainly used machine learning or deep learning to improve the effectiveness of classification,and have achieved good results in experiments.However,most methods have been developed on near real-world datasets for a limited number of traffic types.Most existing methods for classifying encrypted traffic are based on coarse-grained classification,which does not cope well with the growing number of application types and new types of application services,when in fact the current environment demands increasingly fine-grained classification of encrypted traffic.At the same time,encrypted traffic samples are difficult to obtain and their labeling data needs to be manually annotated by professional domain experts,which greatly limits the training of deep learning models.In addition,when faced with new types of application services,a significant volume of data must be collected again to train the model anew.,which is not only time-consuming,but may also be affected by the data collection environment and labelled data,affecting the generalisation ability and accuracy of the model.Regarding the problems mentioned previously,this paper proposes a new zero-shot learning(ZSL)based approach for encrypted traffic classification with both the fine granularity of general classification and good scalability for identifying unknown classes.The main work consists of introducing an attribute space and combining it with feature attributes to achieve the identification of unknown classes in a two-step manner,and the main innovations in the work of this paper are as follows:(1)This paper proposes an attribute semantic space,and constructs a feature-attribute embedding model for learning the mapping between stream features and attributes from known classes,and uses Transformer model for streaming feature embedding,and uses LSTM for attribute embedding.(2)This paper utilizes a self-attentive mechanism on stream sequences for feature extraction of encrypted traffic,significantly reduces the model complexity by progressively compressing the length of hidden state sequences,and captures shallow features and deep features by aggregating information from different layers.(3)This paper proposes a GAN-based feature generation model,which uses the trained model to improve the generalization of the classifier to unknown classes.For the generalized ZSL(GZSL)task,a gradient-based rejection model is introduced to classify known classes and unknown classes in a two-step manner.The experimental results show that the proposed method exhibits excellent performance in fine-grained classification,with the best results reaching close to 99% for fine-grained known classes,and also achieves impressive results in identifying unknown classes,with an improvement of close to 20% compared to the current method.