Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

TL;DR

Deep Packet introduces a deep learning framework combining feature extraction and classification to effectively identify encrypted network traffic and distinguish VPN from non-VPN traffic, outperforming existing methods.

Contribution

This study presents a novel deep learning approach that integrates feature extraction and classification for encrypted traffic, capable of distinguishing VPN traffic, which is a new capability.

Findings

Achieved 0.98 recall in application identification

Achieved 0.94 recall in traffic categorization

Outperforms existing methods on UNB ISCX VPN-nonVPN dataset

Abstract

Internet traffic classification has become more important with rapid growth of current Internet network and online applications. There have been numerous studies on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a \emph{deep learning} based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both \emph{traffic characterization} in which the network traffic is categorized into major classes (\eg, FTP and P2P) and application identification in which end-user applications (\eg, BitTorrent and Skype) identification is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. After an initial pre-processing phase on data, packets are fed into Deep Packet framework that embeds stacked autoencoder and convolution neural network in order to classify network traffic. Deep packet with CNN as its classification model achieved recall of $0.98$ in application identification task and $0.94$ in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.