PacketCGAN: Exploratory Study of Class Imbalance for Encrypted Traffic Classification Using CGAN

TL;DR

This paper introduces PacketCGAN, a Conditional GAN-based data augmentation method to address class imbalance in encrypted traffic classification, improving deep learning model performance on imbalanced datasets.

Contribution

The paper proposes PacketCGAN, a novel traffic data augmentation technique using CGAN to generate specific traffic types and mitigate class imbalance issues.

Findings

PacketCGAN outperforms traditional oversampling methods in traffic classification accuracy.

Augmentation with PacketCGAN improves deep learning model performance on imbalanced datasets.

Experimental results on public datasets validate the effectiveness of PacketCGAN.

Abstract

With more and more adoption of Deep Learning (DL) in the field of image processing, computer vision and NLP, researchers have begun to apply DL to tackle with encrypted traffic classification problems. Although these methods can automatically extract traffic features to overcome the difficulty of traditional classification methods like DPI in terms of feature engineering, a large amount of data is needed to learn the characteristics of various types of traffic. Therefore, the performance of classification model always significantly depends on the quality of datasets. Nevertheless, the building of datasets is a time-consuming and costly task, especially encrypted traffic data. Apparently, it is often more difficult to collect a large amount of traffic samples of those unpopular encrypted applications than well-known, which leads to the problem of class imbalance between major and minor encrypted applications in datasets. In this paper, we proposed a novel traffic data augmenting method called PacketCGAN using Conditional GAN. As a generative model, PacketCGAN exploit the benefit of CGAN to generate specified traffic to address the problem of the datasets' imbalance. As a proof of concept, three classical DL models like Convolutional Neural Network (CNN) were adopted and designed to classify four encrypted traffic datasets augmented by Random Over Sampling (ROS), SMOTE(Synthetic Minority Over-sampling Techinique) , vanilla GAN and PacketCGAN respectively based on two public datasets: ISCX2012 and USTC-TFC2016. The experimental evaluation results demonstrate that DL based encrypted traffic classifier over dataset augmented by PacketCGAN can achieve better performance than the others.