GMTBLC: a deep learning-based bi-modal network traffic classification method

WEI Debin; JIANG Qinlong; WEN Jinglong; WANG Xinrui

doi:10.11959/j.issn.1000-0801.2024251

您当前的位置：

首页 >

文章列表页 >

GMTBLC: a deep learning-based bi-modal network traffic classification method

Research and Development | 更新时间：2024-12-30

- GMTBLC: a deep learning-based bi-modal network traffic classification method
- Telecommunications Science Vol. 40, Issue 12, Pages: 93-106(2024)
- 作者机构：
  
  大连大学信息工程学院，辽宁大连 116622
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61931004)
- DOI：10.11959/j.issn.1000-0801.2024251
  CLC： TP393
- Received：18 October 2024，
  
  Revised：02 November 2024，
  
  Published：20 December 2024
- 稿件说明：
移动端阅览
魏德宾,江亲龙,温京龙等.GMTBLC：基于深度学习的双模态网络流量分类[J].电信科学,2024,40(12):93-106.

WEI Debin,JIANG Qinlong,WEN Jinglong,et al.GMTBLC: a deep learning-based bi-modal network traffic classification method[J].Telecommunications Science,2024,40(12):93-106.
魏德宾,江亲龙,温京龙等.GMTBLC：基于深度学习的双模态网络流量分类[J].电信科学,2024,40(12):93-106. DOI： 10.11959/j.issn.1000-0801.2024251.

WEI Debin,JIANG Qinlong,WEN Jinglong,et al.GMTBLC: a deep learning-based bi-modal network traffic classification method[J].Telecommunications Science,2024,40(12):93-106. DOI： 10.11959/j.issn.1000-0801.2024251.

摘要

网络流量分类对于网络安全维护和网络管理至关重要，在服务质量（quality of service，QoS）保证、入侵检测等任务中得到了广泛的应用。针对传统流量分类模型对特征提取不足，导致分类准确率较低等问题，提出了基于混合注意力（group mix attention

GMA）的Transformer和双向长短期记忆（bi-directional long short term memory，Bi-LSTM）网络的双模态网络流量分类（group mix transformer and Bi-LSTM for traffic classification，GMTBLC）方法。在数据预处理阶段，通过数据包的有效载荷生成会话内的包级别图像，以减少信息干扰。在分类阶段，图像首先由包混合Transformer（packet group mix transformer，PCMT）模块处理，该模块使用Transformer和GMA捕获全局特征。同时，会话图像由时空特征提取（spatio-temporal feature extraction，SFE）模块处理，其中数据包的空间特征由带有残差连接的卷积神经网络提取，数据包的时间特征由双向LSTM提取。在融合分类层中，通过动态加权机制融合上述全局特征和时空特征，最终完成网络流量分类。在公共数据集ISCX和USTC-TFC2016上进行的实验表明，该模型的分类准确率达99.31%，精确率、召回率和F1值均达到98%以上，相比其他模型分类效果更优。

Abstract

Network traffic classification is crucial for network security maintenance and management

and it has been widely applied in tasks

such as quality of service (QoS) assurance and intrusion detection. To address the issues of traditional traffic classification models

such as insufficient feature extraction and low classification accuracy

a dual-modal network traffic classification method based on group mix attention (GMA) with a transformer and a bi-directional long short-term memory (Bi-LSTM) network

named group mix transformer and Bi-LSTM for traffic classification (GMTBLC)

was proposed. In the data preprocessing phase

packet-level images within sessions were generated from the payloads of data packets to reduce information interference. In the classification phase

the images were firstly processed by the packet group mix transformer (PCMT) module

which utilized the transformer and GMA to capture global features. Simultaneously

session images were processed by the spatio-temporal feature extraction (SFE) module

of which the spatial features of packets were extracted by a convolutional neural network with residual connections

and temporal features of packets were extracted by a bi-directional long short-term memory network. In the fusion classification layer

the above global and spatiotemporal features were integrated using a dynamic weighting mechanism to complete network traffic classification. Experimental results on ISCX and USTC-TFC2016 datasets demonstrate that the proposed model achieves a classification accuracy of 99.31%

with precision

recall

and F1-score all above 98%

and outperforms the other models in classification effectiveness.

关键词

Keywords

references

SADEGHZADEH A M , SHIRAVI S , JALILI R . Adversarial network traffic: towards evaluating the robustness of deep-learning-based network traffic classification [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 2 ): 1962 - 1976 .

DORIGUZZI-CORIN R , MILLAR S , SCOTT-HAYWARD S , et al . Lucid: a practical, lightweight deep learning solution for DDoS attack detection [J ] . IEEE Transactions on Network and Service Management , 2020 , 17 ( 2 ): 876 - 889 .

MOLINA-CORONADO B , MORI U , MENDIBURU A , et al . Survey of network intrusion detection methods from the perspective of the knowledge discovery in databases process [J ] . IEEE Transactions on Network and Service Management , 2020 , 17 ( 4 ): 2451 - 2479 .

郭丽 , 刘磊 . 基于多层感知器的流量分类方法研究 [J ] . 电子测量与仪器学报 , 2019 , 33 ( 7 ): 56 - 64 .

GUO L , LIU L . Research on refined classification method based on multilayer perceptron [J ] . Journal of Electronic Measurement and Instrumentation , 2019 , 33 ( 7 ): 56 - 64 .

MOORE A W , PAPAGIANNAKI K . Toward the accurate identification of network applications [M ] // Lecture Notes in Computer Science . Berlin, Heidelberg : Springer Berlin Heidelberg , 2005 : 41 - 54 .

SEN S , SPATSCHECK O , WANG D M . Accurate, scalable in-network identification of p2p traffic using application signatures [C ] // Proceedings of the 13th International Conference on World Wide Web . New York : ACM , 2004 : 512 - 521 .

ROUGHAN M , SEN S , SPATSCHECK O , et al . Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification [C ] // Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement . New York : ACM , 2004 : 135 - 148 .

KHALIFE J M , HAJJAR A , DÍAZ-VERDEJO J . Performance of OpenDPI in identifying sampled network traffic [J ] . Journal of Networks , 2013 , 8 ( 1 ): 71 - 81 .

DERI L , MARTINELLI M , BUJLOW T , et al . nDPI: open-source high-speed deep packet inspection [C ] // Proceedings of the 2014 International Wireless Communications and Mobile Computing Conference (IWCMC) . Piscataway : IEEE Press , 2014 : 617 - 622 .

ZHAO Y , YANG Y R , TIAN B , et al . Edge intelligence based identification and classification of encrypted traffic of Internet of things [J ] . IEEE Access , 1895 , 9 : 21895 - 21903 .

杨宇 , 唐东明 , 李驹光 , 等 . 基于时空特征自适应融合网络的流量分类方法 [J ] . 电子测量技术 , 2024 , 47 ( 3 ): 166 - 174 .

YANG Y , TANG D M , LI J G , et al . Traffic classification based on spatiotemporal feature adaptive fusion network [J ] . Electronic Measurement Technology , 2024 , 47 ( 3 ): 166 - 174 .

AULD T , MOORE A W , GULL S F . Bayesian neural networks for Internet traffic classification [J ] . IEEE Transactions on Neural Networks , 2007 , 18 ( 1 ): 223 - 239 .

庞兴龙 , 朱国胜 . 基于半监督学习的网络流量分析研究 [J ] . 计算机科学 , 2022 , 49 ( S1 ): 544 - 554, 611 .

PANG X L , ZHU G S . Survey of network traffic analysis based on semi supervised learning [J ] . Computer Science , 2022 , 49 ( S1 ): 544 - 554, 611 .

SHEIKH M S , PENG Y Q . Procedures, criteria, and machine learning techniques for network traffic classification: a survey [J ] . IEEE Access , 2022 , 10 : 61135 - 61158 .

DONG S . Multi class SVM algorithm with active learning for network traffic classification [J ] . Expert Systems with Applications , 2021 , 176 : 114885 .

杨永平 , 王思婷 . 基于CNN结合BiGRU的恶意流量分类算法研究 [J ] . 计算机科学 , 2024 , 51 ( 7 ): 1 - 9 .

YANG Y P , WANG S T . Research on malicious traffic classification algorithm based on CNN combined with BiGRU [J ] . Computer Science , 2024 , 51 ( 7 ): 1 - 9 .

WANG W , ZHU M , WANG J L , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . Piscataway : IEEE Press , 2017 : 43 - 48 .

DONG S , LI R X . Traffic identification method based on multiple probabilistic neural network model [J ] . Neural Computing and Applications , 2019 , 31 ( 2 ): 473 - 487 .

XIE G R , LI Q , JIANG Y . Self-attentive deep learning method for online traffic classification and its interpretability [J ] . Computer Networks , 2021 , 196 : 108267 .

SHAPIRA T , SHAVITT Y . FlowPic: a generic representation for encrypted traffic classification and applications identification [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 2 ): 1218 - 1232 .

YANG L , GUO S T , LIU D F , et al . ConViTML: a convolutional vision transformer-based meta-learning framework for real-time edge network traffic classification [J ] . IEEE Transactions on Network and Service Management , 2024 , 21 ( 3 ): 3344 - 3357 .

DONG S , XIA Y J , PENG T . Network abnormal traffic detection model based on semi-supervised deep reinforcement learning [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 4 ): 4197 - 4212 .

DONG S , XIA Y J , PENG T . Traffic identification model based on generative adversarial deep convolutional network [J ] . Annals of Telecommunications , 2022 , 77 ( 9 ): 573 - 587 .

ACETO G , CIUONZO D , MONTIERI A , et al . MIMETIC: mobile encrypted traffic classification using multimodal deep learning [J ] . Computer Networks , 2019 , 165 : 106944 .

WANG X , CHEN S H , SU J S . App-net: a hybrid neural network for encrypted mobile traffic classification [C ] // Proceedings of the IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . Piscataway : IEEE Press , 2020 : 424 - 429 .

LIN P , YE K J , HU Y S , et al . A novel multimodal deep learning framework for encrypted traffic classification [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 3 ): 1369 - 1384 .

LIN K D , XU X L , GAO H H . TSCRNN: a novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT [J ] . Computer Networks , 2021 , 190 : 107974 .

ZHU S Z , XU X L , GAO H H , et al . CMTSNN: a deep learning model for multiclassification of abnormal and encrypted traffic of Internet of things [J ] . IEEE Internet of Things Journal , 2023 , 10 ( 13 ): 11773 - 11791 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [J ] . Advances in Neural Information Processing Systems , 2017 , 30 : 6000 – 6010 .

GE C J , DING X H , TONG Z , et al . Advancing vision transformers with group-mix attention [EB ] . 2023 .

DAI Y M , GIESEKE F , OEHMCKE S , et al . Attentional feature fusion [C ] // Proceedings of the 2021 IEEE Winter Conference on Applications of Computer Vision (WACV) . Piscataway : IEEE Press , 2021 : 3559 - 3568 .

WANG W , ZHU M , ZENG X W , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // Proceedings of the 2017 International Conference on Information Networking (ICOIN) . Piscataway : IEEE Press , 2017 : 712 - 717 .

HUOH T L , LUO Y , LI P L , et al . Flow-based encrypted network traffic classification with graph neural networks [J ] . IEEE Transactions on Network and Service Management , 2023 , 20 ( 2 ): 1224 - 1237 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on new energy station network security assessment method based on improved LSTM network

Research on antenna dip angle recognition method based on improved YOLOv5

Mixed signal modulation recognition method based on temporal depth residual shrinkage network

Dynamic heterogeneous network representation learning method based on Hawkes process

Research on fault prediction of computer network nodes driven by log information

Related Author

LIU Shan

LI Rui

WANG Yao

ZHANG Ning

PAN Feng

GENG Lujing

CHEN Zuhao

XU Tingting

Related Institution

State Grid Shanxi Electric Power Company

State Grid Shanxi Electric Power Research Institute

China Mobile Group Design Institute Co., Ltd.

China Mobile Group Co., Ltd.

The 63rd Research Institute, National University of Defense Technology

⁰