GMAF: A Novel Gradient-Based Model with ArcFace for Network Traffic Classification

As the Internet rapidly develops, network applications emerge everywhere and every time on the Internet. Therefore, to effectively regulate the network environment and maintain network security, it is significant to recognize and classify the network traffic correctly. The existing Deep Learning methods are based on a strong assumption—the training set contains all the classes of applications. However, different from the natural and complex network environment, new applications emerge every time, or existing applications generate new behaviors, bringing numerous unknown traffic. Unknown traffic significantly reduces classification accuracy so that it will not only threaten network security but also bring new challenges to supervise the network. The paper proposes “GMAF”, a novel gradient-based model with Additive Angular Margin loss (ArcFace) for open-world network traffic classification. Specifically, the gradient of ArcFace loss layer's weights through the first backpropagation is adopted to identify known traffic and unknown traffic, since its weights have carried the critical information of known traffic after training. Moreover, ArcFace contributes to obtaining highly discriminative features because an additive angular margin penalty is added to the angular between the features and weights. In addition, we adopt class-balanced focal loss to assign more weight for the hard samples and the minority classes, mitigating the effects of class imbalance in the real world. The evaluation results demonstrate that the proposed method can accurately reject the unknown traffic while misidentifies known traffic as little as possible under different scenarios, better than existing advanced research methods. Furthermore, GMAF still works well as the number of unknown classes increases.