Encrypted Mobile Traffic Classification with a Few-shot Incremental Learning Approach

Mobile traffic classification is an essential task for network security and management. Even though some progress has been made, the existing methods have limitations regarding plasticity and the requirement for large amounts of labeled data for training. In real-world wireless networks, new applications are constantly emerging. The lack of plasticity means the model must be retrained entirely whenever a larger dataset with new classes is obtained, which is time-consuming. Furthermore, obtaining large amounts of labeled data is often complicated and expensive. To overcome these limitations, we proposed a novel approach for classifying encrypted mobile traffic using the few-shot incremental learning with a Long Short-Term Memory (LSTM) model. We pre-train an LSTM model with a base dataset, then incrementally add classes and update the model with few-shot datasets. We leverage the exemplar selection and knowledge distillation to keep the stability and plasticity of the model. We validate our method by collecting Downlink Control Information (DCI) of twenty different mobile applications from commercial Long Term Evolution (LTE) networks. Our experimental results demonstrate the effectiveness of the proposed method.