BTP-CAResNet: An Encrypted Traffic Classification Method Based on Byte Transfer Probability and Coordinate Attention Mechanism

With the extensive application of network traffic encryption technology, the accurate and efficient classification of encrypted traffic has become a critical need for network management. Deep learning has become the predominant method for traffic classification, primarily involving the transformation of network traffic into grayscale images and their subsequent classification using Convolutional Neural Networks (CNNs). However, traditional grayscale image generation methods are plagued with issues of redundant and lost information, and conventional channel attention mechanisms are still insufficient in capturing key traffic features, collectively hindering the enhancement of classification performance. To tackle these issues, this paper introduces a classification method based on Byte Transfer Probability and Coordinate Attention Mechanism in Residual Network (BTP-CAResNet). This method, on the foundation of the classic ResNet architecture, incorporates a new grayscale image generation method that utilizes Byte Transfer Probability, effectively overcoming the deficiencies of traditional approaches. Additionally, this paper integrates a Coordinate Attention Mechanism into the ResNet model, which effectively overcomes the limitations of traditional channel attention mechanisms and further improves the performance of traffic classification. Experimental validation on the ISCX VPN-nonVPN dataset demonstrates that, compared to previous CNN-based methods, the method proposed in this paper exhibits superior performance in key metrics such as accuracy, precision, recall, and F1 score. It provides a new perspective for traffic classification based on convolutional neural networks.