Combo Packet:An Encryption Traffic Classification Method Based on Contextual Information  

作　　者：Yuancong Chai Yuefei Zhu Wei Lin Ding Li 

机构地区：[1]State Key Laboratory of Mathematical Engineering and Advanced Computing,Information Engineering University,Zhengzhou,450001,China

出　　处：《Computers, Materials & Continua》2024年第4期1223-1243,共21页计算机、材料和连续体（英文）

基　　金：the National Natural Science Foundation of China Youth Project(62302520).

摘　　要：With the increasing proportion of encrypted traffic in cyberspace, the classification of encrypted traffic has becomea core key technology in network supervision. In recent years, many different solutions have emerged in this field.Most methods identify and classify traffic by extracting spatiotemporal characteristics of data flows or byte-levelfeatures of packets. However, due to changes in data transmission mediums, such as fiber optics and satellites,temporal features can exhibit significant variations due to changes in communication links and transmissionquality. Additionally, partial spatial features can change due to reasons like data reordering and retransmission.Faced with these challenges, identifying encrypted traffic solely based on packet byte-level features is significantlydifficult. To address this, we propose a universal packet-level encrypted traffic identification method, ComboPacket. This method utilizes convolutional neural networks to extract deep features of the current packet andits contextual information and employs spatial and channel attention mechanisms to select and locate effectivefeatures. Experimental data shows that Combo Packet can effectively distinguish between encrypted traffic servicecategories (e.g., File Transfer Protocol, FTP, and Peer-to-Peer, P2P) and encrypted traffic application categories (e.g.,BitTorrent and Skype). Validated on the ISCX VPN-non VPN dataset, it achieves classification accuracies of 97.0%and 97.1% for service and application categories, respectively. It also provides shorter training times and higherrecognition speeds. The performance and recognition capabilities of Combo Packet are significantly superior tothe existing classification methods mentioned.

关 键 词：Encrypted traffic classification packet-level convolutional neural network attention mechanisms 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]