Cybersecurity Meets AI: Encrypted Traffic Classification using Bidirectional LSTM and CNN Architecture

Application classification from encrypted traffic boosts network security and performance. It detects threats, enforces access controls, and optimizes resource allocation, ensuring compliance and preventing data breaches. To classify encrypted internet traffic and enhance network security, we developed a methodology utilizing the Dataset-TLS [1], comprising Transport Layer Security (TLS) traces from 28 Android apps. We preprocessed the data by converting network flows into packets, extracting features like Payload Length, TCP Window size, and Timestamp, and balancing the data into equal-sized chunks. We then trained and evaluated Bidirectional LSTM (Bi-LSTM) and Convolutional Neural Network (CNN) deep learning models, assessing metrics such as accuracy, recall, precision, and F-1 score. This comprehensive approach facilitates the identification of the most effective classification method for encrypted traffic, ultimately enhancing network performance and mitigating emerging security threats. The proposed deep learning method achieved the highest accuracy on test data of 97% with Bidirectional-LSTM. These results demonstrate that deep learning models can be effectively employed for efficient application classification from encrypted traffic.