Hybrid feature learning framework for the classification of encrypted network traffic

Figures & data

Figure 1. Feature learning using neural network followed by SVM classification.

Figure 2. Classification architecture without feature extraction.

Figure 3. Classification architecture with feature extraction using deep learning.

Figure 4. True positive rate vs number of hidden layers in DNN.

Table 1. List of acronyms.

Acronym	Description
SVM	Support vector machine
TC	Traffic classification
DNN	Deep learning neural network
VPN	Virtual private networks
PCA	Principal component analysis
NN	Neural networks
ROC	Receiver operating characteristic curve
AUC	Area under the curve

Table 2. Comparative study of related works.

Research article	Encrypted traffic	WhatsApp data	Dataset type	Methodology
Lotfollahi et al. (2020)	Yes	No	UNB ISCX VPN-nonVPN dataset	CNN
Wang et al. (2017)	Yes	No	ISCX VPN-nonVPN traffic dataset	DNN
Wang et al. (2018)	Yes	No	ISCX VPN-nonVPN	Stacked autoencoder+DNN+CNN
Wang et al. (2018)	Yes	No	Private dataset	Ensemble of deep learning methods
Aceto et al. (2019)	Yes	No	Human generated mobile traffic data set	DNN
Aceto et al. (2021)	Yes	No	ISCX VPN-nonVPN	DNN
This Paper	Yes	Yes	UNB ISCX VPN + Private data	DNN + ML

Table 3. Recent challenges and proposed solutions.

S.No	Recent challenges	Solution in the proposed system
1	The ISCXVPN2016 dataset has been commonly utilised in recent research related to classifying encrypted network traffic. However, it is important to note that this dataset does not include network packets from mobile apps such as WhatsApp.	In the proposed work the WhatsApp network packets are added with the ISCXVPN2016 dataset
2	One of the current challenges in research is the insufficient attention given to feature engineering in the context of classifying encrypted network traffic.	In the current research the feature learning process is automated with deep learning methods like deep neural network, PCA, Autoencoder

Table 4. Neural network layers.

Layer (type)	Output shape	Parameters
m1 input (Dense)	(None, 46)	141,358
m1 hidden1 (Dense)	(None, 20)	141,358
m1 hidden2 (Dense)	(None, 46)	940
m1 output (Dense)	(None, 2)	210

Table 5. Demonstration of deep neural network layers.

Number of layers	Loss function	Optimisation function
4	Sparse categorical loss	Sparse categorical entropy

Table 6. Dataset information.

Application	Number of samples
WhatsApp	38,804
Facebook messenger	13,060
Email	11,260
Hangout	900
Browsing	8000

Table 7. Comparison of various feature learning process for application identification.

Model	Precision	Recall	F1
SVM	0.87	0.85	0.83
Neural network	0.87	0.85	0.86
Neural network + SVM	0.93	0.92	0.90
Autoencoder+SVM	0.85	0.83	0.82
PCA + SVM	0.69	0.75	0.72

Table 8. Comparison of SVM and proposed work (NN + SVM) for classification WhatsApp media content (image/text).

Model	Precision	Recall	F1
SVM	0.68	0.99	0.78
Neural network	0.79	0.85	0.85
Neural network + SVM	0.81	0.93	0.90
Autoencoder+SVM	0.79	0.91	0.83
PCA + SVM	0.68	0.98	0.80

Table 9. Comparison of various machine learning models for application identification.

Model	Precision	Recall	F1
Random Forest	0.70	0.80	0.75
Logistic Regression	0.65	0.75	0.70
SVM	0.87	0.85	0.83

Figure 5. Experimental setup for dataset collection.

Figure 6. Precision, recall, F1 comparison between models for classifying WhatsApp application from others.

Figure 7. Precision, recall, F1 comparison between models for classifying other application from others.

Figure 8. Precision, recall,F1 comparison between models for WhatsApp image.

Table 10. Comparison of various machine learning models for classification of WhatsApp media Content (image/text).

Model	Precision	Recall	F1
Random forest	0.75	0.80	0.78
Logistic regression	0.78	0.75	0.73
SVM	0.68	0.99	0.78

Table 11. Comparison of proposed methodology with other state of the art deep learning methods in classifying VPN traffic application.

Model	Precision
Lotfollahi et al. (2020)	0.93
Wang et al. (2017)	0.92
Aceto et al. (2021)	0.83
Proposed methodology	0.94

Table 12. Autoencoder layer details.

Layer	Activation	Dimension
Input	No	45
Layer 1 Dense	Relu	30
Layer 2 Dense	Relu	10
Layer 3 Dense	Relu	30
Output	Sigmoid	45

Figure 9. Precision, recall, F1 comparison between models for WhatsApp text.

Figure 10. ROC curve for autoencoders + SVM.

Figure 11. ROC curve for neural network + SVM.

Lotfollahi, M., Jafari Siavoshani, M., Shirali Hossein Zade, R., & Saberian, M. (2020). Deep packet: A novel approach for encrypted traffic classification using deep learning. Soft Computing, 24(3), 1999–2012. https://doi.org/10.1007/s00500-019-04030-2

 Web of Science ®Google Scholar

Wang, W., Zhu, M., Wang, J., Zeng, X., & Yang, Z. (2017). End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) (pp. 43–48).

 Google Scholar

Wang, P., Ye, F., Chen, X., & Qian, Y. (2018). Datanet: deep learning based encrypted network traffic classification in sdn home gateway. IEEE Access, 6(1), 55380–55391. doi: 10.1109/ACCESS.2018.2872430

 Google Scholar

Aceto, G., Ciuonzo, D., Montieri, A., & Pescapé, A. (2019). Mimetic: Mobile encrypted traffic classification using multimodal deep learning. Computer Networks, 165, 106944. https://doi.org/10.1016/j.comnet.2019.106944

 Web of Science ®Google Scholar

Aceto, G., Ciuonzo, D., Montieri, A., & Pescapé, A. (2021). Distiller: Encrypted traffic classification via multimodal multitask deep learning. Journal of Network and Computer Applications, 183–184, 102985. https://doi.org/10.1016/j.jnca.2021.102985

 Web of Science ®Google Scholar