AutoML4ETC: Automated Neural Architecture Search for Real-World Encrypted Traffic Classification

TL;DR

AutoML4ETC introduces an automated neural architecture search tool tailored for encrypted traffic classification, achieving superior accuracy and efficiency on multiple datasets, including real-world network traffic, reducing manual tuning efforts.

Contribution

It presents a novel search space and automated method for designing high-performing neural networks specifically for encrypted traffic classification tasks.

Findings

Outperforms state-of-the-art classifiers on benchmark datasets.

Generates architectures that are more accurate and parameter-efficient.

Validated on real-world TLS and QUIC traffic from mobile networks.

Abstract

Deep learning (DL) has been successfully applied to encrypted network traffic classification in experimental settings. However, in production use, it has been shown that a DL classifier's performance inevitably decays over time. Re-training the model on newer datasets has been shown to only partially improve its performance. Manually re-tuning the model architecture to meet the performance expectations on newer datasets is time-consuming and requires domain expertise. We propose AutoML4ETC, a novel tool to automatically design efficient and high-performing neural architectures for encrypted traffic classification. We define a novel, powerful search space tailored specifically for the early classification of encrypted traffic using packet header bytes. We show that with different search strategies over our search space, AutoML4ETC generates neural architectures that outperform the state-of-the-art encrypted traffic classifiers on several datasets, including public benchmark datasets and real-world TLS and QUIC traffic collected from the Orange mobile network. In addition to being more accurate, AutoML4ETC's architectures are significantly more efficient and lighter in terms of the number of parameters. Finally, we make AutoML4ETC publicly available for future research.