Listen to Minority: Encrypted Traffic Classification for Class Imbalance with Contrastive Pre-Training

TL;DR

This paper introduces PASS, a semi-supervised, contrastive pre-training framework for encrypted traffic classification that effectively handles class imbalance, traffic homogeneity, and reduces reliance on labeled data, outperforming existing methods.

Contribution

The paper proposes a novel contrastive pre-training and semi-supervised strategy that addresses class imbalance, traffic homogeneity, and label scarcity in encrypted traffic classification.

Findings

PASS outperforms state-of-the-art ETC methods on multiple datasets.

Contrastive pre-training improves feature robustness for overlapping traffic.

Pseudo-label iteration enhances utilization of unlabeled data.

Abstract

Mobile Internet has profoundly reshaped modern lifestyles in various aspects. Encrypted Traffic Classification (ETC) naturally plays a crucial role in managing mobile Internet, especially with the explosive growth of mobile apps using encrypted communication. Despite some existing learning-based ETC methods showing promising results, three-fold limitations still remain in real-world network environments, 1) label bias caused by traffic class imbalance, 2) traffic homogeneity caused by component sharing, and 3) training with reliance on sufficient labeled traffic. None of the existing ETC methods can address all these limitations. In this paper, we propose a novel Pre-trAining Semi-Supervised ETC framework, dubbed PASS. Our key insight is to resample the original train dataset and perform contrastive pre-training without using individual app labels directly to avoid label bias issues caused by class imbalance, while obtaining a robust feature representation to differentiate overlapping homogeneous traffic by pulling positive traffic pairs closer and pushing negative pairs away. Meanwhile, PASS designs a semi-supervised optimization strategy based on pseudo-label iteration and dynamic loss weighting algorithms in order to effectively utilize massive unlabeled traffic data and alleviate manual train dataset annotation workload. PASS outperforms state-of-the-art ETC methods and generic sampling approaches on four public datasets with significant class imbalance and traffic homogeneity, remarkably pushing the F1 of Cross-Platform215 with 1.31%, ISCX-17 with 9.12%. Furthermore, we validate the generality of the contrastive pre-training and pseudo-label iteration components of PASS, which can adaptively benefit ETC methods with diverse feature extractors.