An Advanced Hybrid Model for Network Traffic Classification

以作者查詢圖書館館藏

、以作者查詢臺灣博碩士

、以作者查詢全國書目

、勘誤回報

、線上人數：9

、訪客IP：3.19.76.4

姓名

翁梓育(Zih-Yu Wong) 查詢紙本館藏

畢業系所

資訊工程學系在職專班

論文名稱

(An Advanced Hybrid Model for Network Traffic Classification)

相關論文

★ Dynamic Overlay Construction for Mobile Target Detection in Wireless Sensor Networks	★ 車輛導航的簡易繞路策略
★ 使用傳送端電壓改善定位	★ 利用車輛分類建構車載網路上的虛擬骨幹
★ Why Topology-based Broadcast Algorithms Do Not Work Well in Heterogeneous Wireless Networks?	★ 針對移動性目標物的有效率無線感測網路
★ 適用於無線隨意網路中以關節點為基礎的分散式拓樸控制方法	★ A Review of Existing Web Frameworks
★ 將感測網路切割成貪婪區塊的分散式演算法	★ 無線網路上Range-free的距離測量
★ Inferring Floor Plan from Trajectories	★ An Indoor Collaborative Pedestrian Dead Reckoning System
★ Dynamic Content Adjustment In Mobile Ad Hoc Networks	★ 以影像為基礎的定位系統
★ 大範圍無線感測網路下分散式資料壓縮收集演算法	★ 車用WiFi網路中的碰撞分析

檔案

[Endnote RIS 格式]

[Bibtex 格式]

[相關文章]

[文章引用]

[完整記錄]

[館藏目錄]

至系統瀏覽論文 (2025-10-15以後開放)

摘要(中)

網絡流量分類對於網絡安全至關重要，因為它有助於檢測異常流量和潛在的攻擊模式，從而實現及時的防護措施。隨著遠程工作、視頻會議和 VPN 服務的廣泛應用，網絡流量的快速增長增加了流量分類的複雜性。傳統方法，如基於端口的分類、深度封包檢查（DPI）和機器學習（ML），在處理複雜和加密流量時存在局限性。在本研究中，我們提出了一個新穎的網絡流量分類系統，該系統結合了 1D-CNN 和 Transformer 來提取局部和長距離特徵，並融合這些互補特徵以提高分類能力。使用 ISCX VPNnonVPN 數據集的實驗結果顯示，與基線方法相比，我們提出的系統在大多數類別中的準確率、召回率和 F1 分數上均具有更好的表現。

摘要(英)

Network traffic classification is crucial for cybersecurity, as it helps detect abnormal traffic and potential attack patterns, enabling timely protective measures. With the widespread adoption of remote work, video conferencing, and VPN services, the rapid growth of network traffic has increased the complexity of traffic classification. Traditional methods, such as port-based classification, Deep Packet Inspection, and Machine Learning (ML), face limitations in handling complex and encrypted traffic. In this study, we propose a novel network traffic classification system that combines 1D-CNN and Transformer, utilizing different activation functions to extract both local and long-range features. These complementary features are fused together to improve classification capability. The experimental results on the ISCX VPN-nonVPN dataset indicate that our proposed system surpasses baseline methods across most categories with respect to Precision, Recall, and F1-score.

關鍵字(中)

★ 深度學習

關鍵字(英)

★ Transformer

論文目次

1 Introduction 1
2 Related Work 3
2.1 Network Flow Classification . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1.1 Traditional Network Flow Classification . . . . . . . . . . . . . . . 3
2.1.2 Machine Learning-Based Network Flow Classification . . . . . . . . 4
2.1.3 Deep Learning-Based Network Flow Classification . . . . . . . . . . 6
3 Preliminary 7
3.1 Scapy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2 Convolutional Neural Networks . . . . . . . . . . . . . . . . . . . . . . . . 8
3.3 Self Attention Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.4 Transformer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.5 Sigmoid-weighted Linear Unit . . . . . . . . . . . . . . . . . . . . . . . . . 13
4 Design 15
4.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.2 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.3 Research Challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.4 System Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.4.1 Network packet preprocessing . . . . . . . . . . . . . . . . . . . . . 17
4.4.2 Traffic classification model . . . . . . . . . . . . . . . . . . . . . . . 20
5 Performance 25
5.1 Dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.2 Performance Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.3 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.4 Experimental Results and Analysis . . . . . . . . . . . . . . . . . . . . . . 28
5.5 Ablation Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6 Conclusions 36

參考文獻

[1] Mohammad Lotfollahi, Mahdi Jafari Siavoshani, Ramin Shirali Hossein Zade, and Mohammdsadegh Saberian. Deep packet: A novel approach for encrypted traffic classification using deep learning. Soft Computing, 24(3):1999–2012, 2020.
[2] Tal Shapira and Yuval Shavitt. Flowpic: Encrypted internet traffic classification is as easy as image recognition. In IEEE INFOCOM 2019-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pages 680–687. IEEE, 2019.
[3] Feifei Hu, Situo Zhang, Xubin Lin, Liu Wu, Niandong Liao, and Yanqi Song. Network traffic classification model based on attention mechanism and spatiotemporal features. EURASIP Journal on Information Security, 2023(1):6, 2023.
[4] EDGE Technologies. Global internet traffic growth forecast: Looking forward from 2024. https://edgeoptic.com/global-internet-traffic-growth-forecast-looking-forward-from-2024/. Accessed: 2024-06-19.
[5] Cisco, Inc. Cisco annual internet report. https://www.cisco.com/c/en/us/solutions/collateral/executive-perspectives/annual-internet-report/white-paper-c11-741490.html. Accessed: 2024-06-19.
[6] Luca Schumann, Trinh Viet Doan, Tanya Shreedhar, Ricky Mok, and Vaibhav Bajpai. Impact of evolving protocols and covid-19 on internet traffic shares. arXiv preprint arXiv:2201.00142, 2022.
[7] Canadian Centre for Cyber Security. Cyber threat bulletin: Impact of covid-19 on cyber threat activity. https://www.cyber.gc.ca/en/guidance/ cyber-threat-bulletin-impact-covid-19-cyber-threat-activity.
[8] Gerard Draper-Gil, Arash Habibi Lashkari, Mohammad Saiful Islam Mamun, and Ali A Ghorbani. Characterization of encrypted and vpn traffic using time-related. In Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP), pages 407–414, 2016.
[9] Michelle Cotton, Lars Eggert, Joe Touch, Magnus Westerlund, and Stuart Cheshire. Internet assigned numbers authority (iana) procedures for the management of the service name and transport protocol port number registry. Technical report, 2011.
[10] William Stallings. Data and computer communications. Pearson Education India, 2007.
[11] Thomas Karagiannis, Andre Broido, Michalis Faloutsos, and KC Claffy. Transport layer identification of p2p traffic. In Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pages 121–134, 2004.
[12] Grenville J Armitage. Inferring the extent of network address port translation at public/private internet boundaries. Centre for Advanced Internet Architectures, Swinburne University of Technology, Melbourne, Australia, Tech. Rep. A, 20712:12, 2002.
[13] Thomas Karagiannis, Andre Broido, Nevil Brownlee, Kimberly C Claffy, and Michalis Faloutsos. Is p2p dying or just hiding?[p2p traffic measurement]. In IEEE Global Telecommunications Conference, 2004. GLOBECOM’04., volume 3, pages 1532–1538. IEEE, 2004.
[14] Matthew Roughan, Subhabrata Sen, Oliver Spatscheck, and Nick Duffield. Class-ofservice mapping for qos: a statistical signature-based approach to ip traffic classification. In Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pages 135–148, 2004.
[15] HaiTao He, XiaoNan Luo, FeiTeng Ma, ChunHui Che, and JianMin Wang. Network traffic classification based on ensemble learning and co-training. Science in China Series F: Information Sciences, 52(2):338–346, 2009.
[16] Huawei Huang, Peng Li, and Song Guo. Traffic scheduling for deep packet inspection in software-defined networks. Concurrency and computation: practice and experience, 29(16):e3967, 2017.
[17] Young-Hoon Goo, Kyu-Seok Shim, Su-Kang Lee, and Myung-Sup Kim. Payload signature structure for accurate application traffic classification. In 2016 18th AsiaPacific Network Operations and Management Symposium (APNOMS), pages 1–4, 2016.
[18] Fang Yu, Zhifeng Chen, Yanlei Diao, T. V. Lakshman, and Randy H. Katz. Fast and memory-efficient regular expression matching for deep packet inspection. In 2006 Symposium on Architecture For Networking And Communications Systems, pages 93–102, 2006.
[19] Christopher L Hayes and Yan Luo. Dpico: a high speed deep packet inspection engine using compact finite automata. In Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems, pages 195–203, 2007.
[20] Yibo Xue, Dawei Wang, and Luoshi Zhang. Traffic classification: Issues and challenges. In 2013 International Conference on Computing, Networking and Communications (ICNC), pages 545–549. IEEE, 2013.
[21] Andrew W Moore and Denis Zuev. Internet traffic classification using bayesian analysis techniques. In Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, pages 50–60, 2005.
[22] Ruchika Aggarwal and Nanhay Singh. A new hybrid approach for network traffic classification using svm and na‥?ve bayes algorithm. Int. J. Comput. Sci. Mobile Comput, 6:168–174, 2017.
[23] Juliana Vergara-Reyes, Maria Camila Martinez-Ordonez, Armando Ordonez, and Oscar Mauricio Caicedo Rendon. Ip traffic classification in nfv: A benchmarking of supervised machine learning algorithms. In 2017 IEEE Colombian Conference on Communications and Computing (COLCOM), pages 1–6, 2017.
[24] Ahmed Abdelmoamen Ahmed and Gbenga Agunsoye. A real-time network traffic classifier for online applications using machine learning. Algorithms, 14(8):250, 2021.
[25] Ali Ahlashkari. CICFlowMeter. https://github.com/ahlashkari/CICFlowMeter, 2023.
[26] J Ross Quinlan. C4. 5: programs for machine learning. Elsevier, 2014.
[27] Baris Yamansavascilar, M Amac Guvensan, A Gokhan Yavuz, and M Elif Karsligil. Application identification via network traffic classification. In 2017 International Conference on Computing, Networking and Communications (ICNC), pages 843–848. IEEE, 2017.
[28] Leif E Peterson. K-nearest neighbor. Scholarpedia, 4(2):1883, 2009.
[29] Andrew Moore, Denis Zuev, and Michael Crogan. Discriminators for use in flowbased classification. Technical report, 2013.
[30] Jeffrey Erman, Martin Arlitt, and Anirban Mahanti. Traffic classification using clustering algorithms. In Proceedings of the 2006 SIGCOMM workshop on Mining network data, pages 281–286, 2006.
[31] John A Hartigan and Manchek A Wong. Algorithm as 136: A k-means clustering algorithm. Journal of the royal statistical society. series c (applied statistics), 28(1):100–108, 1979.
[32] Xiaowei Xu, M. Ester, H.-P. Kriegel, and J. Sander. A distribution-based clustering algorithm for mining in large spatial databases. In Proceedings 14th International Conference on Data Engineering, pages 324–331, 1998.
[33] Peter Cheeseman, James Kelly, Matthew Self, John Stutz, Will Taylor, and Don Freeman. Autoclass: A bayesian classification system. In Machine learning proceedings 1988, pages 54–64. Elsevier, 1988.
[34] Peng Xiao, Na Liu, Yuanyuan Li, Ying Lu, Xiao-jun Tang, Hai-wen Wang, and Mingxia Li. A traffic classification method with spectral clustering in sdn. In 2016 17th International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT), pages 391–394. IEEE, 2016.
[35] Jinghua Yan and Jing Yuan. A survey of traffic classification in software defined networks. In 2018 1st IEEE International Conference on Hot Information-Centric Networking (HotICN), pages 200–206. IEEE, 2018.
[36] Adrian Lara, Anisha Kolasani, and Byrav Ramamurthy. Network innovation using openflow: A survey. IEEE communications surveys & tutorials, 16(1):493–512, 2013.
[37] Wei Wang, Ming Zhu, Jinlin Wang, Xuewen Zeng, and Zhongzhen Yang. End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In 2017 IEEE international conference on intelligence and security informatics (ISI), pages 43–48. IEEE, 2017.
[38] R Rohith, Minal Moharir, G Shobha, et al. Packet generation. In 2018 international conference on networking, embedded and wireless systems (ICNEWS), pages 1–5. IEEE, 2018.
[39] R Rohith, Minal Moharir, G Shobha, et al. Packet sniffing. In 2018 international conference on networking, embedded and wireless systems (ICNEWS), pages 1–5. IEEE, 2018.
[40] R Rohith, Minal Moharir, G Shobha, et al. Packet dissection. In 2018 international conference on networking, embedded and wireless systems (ICNEWS), pages 1–5. IEEE, 2018.
[41] Saad Albawi, Tareq Abed Mohammed, and Saad Al-Zawi. Understanding of a convolutional neural network. In 2017 international conference on engineering and technology (ICET), pages 1–6. Ieee, 2017.
[42] Weili Fang, Peter ED Love, Hanbin Luo, and Lieyun Ding. Computer vision for behaviour-based safety in construction: A review and future directions. Advanced Engineering Informatics, 43:100980, 2020.
[43] Spyros G Tzafestas. Introduction to mobile robot control. Elsevier, 2013.
[44] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
[45] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pretraining of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018.
[46] Alec Radford. Improving language understanding by generative pre-training. 2018.
[47] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020.
[48] Stefan Elfwing, Eiji Uchibe, and Kenji Doya. Sigmoid-weighted linear units for neural network function approximation in reinforcement learning. Neural networks, 107:3–11, 2018.
[49] Prajit Ramachandran, Barret Zoph, and Quoc V. Le. Searching for activation functions. CoRR, abs/1710.05941, 2017.
[50] TechNews Taiwan Inc. AMD company data has been hacked, 2024. Accessed: 2024-06-20.
[51] Central News Agency. JAXA has been hacked, 2024. Accessed: 2024-06-21.
[52] Wireshark Foundation. Wireshark: The world’s most popular network protocol analyzer. Accessed: 2023-03-23.
[53] The Tcpdump Team. Packet capture (pcap). Accessed: 2023-12-24.
[54] IEEE. Maximum transmission unit (mtu). Defined in IEEE 802.3 Standard. Accessed: 2024-08-26.
[55] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
[56] Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, 15(1):1929–1958, 2014.
[57] John G Proakis. Digital signal processing: principles, algorithms, and applications, 4/E. Pearson Education India, 2007.
[58] Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv:1607.06450, 2016.
[59] Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 448–456. pmlr, 2015.
[60] Shibani Santurkar, Dimitris Tsipras, Andrew Ilyas, and Aleksander Madry. How does batch normalization help optimization? Advances in neural information processing systems, 31, 2018.
[61] Wikipedia contributors. Interpolation — Wikipedia, the free encyclopedia, 2024. [Online; accessed 13-May-2024].
[62] Bolin Gao and Lacra Pavel. On the properties of the softmax function with application in game theory and reinforcement learning. arXiv preprint arXiv:1704.00805, 2017.
[63] OpenVPN Technologies, Inc. Openvpn, 2016. Accessed: 2024-08-26.
[64] DP Kingma. Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
[65] Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415, 2016.

指導教授

孫敏德(Min-Te Sun)

審核日期

2024-12-6

推文