Less is More: Simplifying Network Traffic Classification Leveraging RFCs

TL;DR

This paper introduces NetMatrix, a simplified network traffic representation based on RFCs, combined with XGBoost, achieving high classification accuracy with significantly reduced resource consumption.

Contribution

The paper presents NetMatrix and LiM, a minimalistic traffic classification approach that outperforms complex models in resource efficiency while maintaining accuracy.

Findings

LiM achieves classification performance comparable to state-of-the-art methods.

LiM significantly reduces resource consumption compared to existing approaches.

NetMatrix effectively eliminates noisy features, simplifying traffic classification.

Abstract

The rapid growth of encryption has significantly enhanced privacy and security while posing challenges for network traffic classification. Recent approaches address these challenges by transforming network traffic into text or image formats to leverage deep-learning models originally designed for natural language processing, and computer vision. However, these transformations often contradict network protocol specifications, introduce noisy features, and result in resource-intensive processes. To overcome these limitations, we propose NetMatrix, a minimalistic tabular representation of network traffic that eliminates noisy attributes and focuses on meaningful features leveraging RFCs (Request for Comments) definitions. By combining NetMatrix with a vanilla XGBoost classifier, we implement a lightweight approach, LiM ("Less is More") that achieves classification performance on par with state-of-the-art methods such as ET-BERT and YaTC. Compared to selected baselines, experimental evaluations demonstrate that LiM improves resource consumption by orders of magnitude. Overall, this study underscores the effectiveness of simplicity in traffic representation and machine learning model selection, paving the way towards resource-efficient network traffic classification.