SemiAF: Semi-Supervised App Fingerprinting on Unknown Traffic via Graph Neural Network

Application Fingerprinting (AF) enables the identification of applications via traffic analysis, aiding network administrators in comprehending user behavior. However, a large volume of unknown traffic in real network environments poses significant challenges for AF methods in both differentiating unknown traffic and characterizing unknown apps. To address these challenges, we introduce a Semi-Supervised App Fingerprinting (SemiAF) deep learning framework. Specifically, to tackle the unknown traffic differentiating challenge, a semi-supervised contrastive learning method is employed to differentiate and cluster unknown applications. To characterize the features of unknown apps, we present a novel In-Flow Burst Interaction (IFBI) graph where each node represents a fine-grained action. By decomposing the unknown app traffic into combinations of these fine-grained actions, a deeper understanding of the network patterns can be achieved. Furthermore, we introduce an explainable neural network framework, revealing the network traffic interactions and inherent relationships. Extensive experimental results in three scenarios demonstrate that SemiAF outperforms state-of-the-art methods in unknown application recognition.