Adaptive Encrypted Traffic Characterization via Deep Representation Learning

Near ubiquitous encryption poses a challenge for security and quality of service (QoS) applications that rely on deep packet inspection (DPI) techniques for categorizing traffic types or threats. However, recent work has shown that machine learning (ML) on temporal flow statistics as well as convolutional neural network (CNN) methods applied to raw packets are able to classify network traffic even in the face of encryption. Unfortunately, many such methods often lack the ability to generalize to new categories, a critical requirement in our constantly evolving networks. Building on previous approaches we apply CNN models to the characterization task within a deep representation learning framework. The network acts as a feature extractor which is input to a lightweight support vector machine (SVM) classifier for the final output. By training the networks with an angular softmax loss in addition to the typical crossentropy loss, we can improve on the state of the art in terms of both classification accuracy and detection error. Furthermore we demonstrate that learned features provide the ability to label traffic categories not seen in neural network training.