[Paper Review] Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

Mohammad Nader Lotfollahi, Ramin Shirali Hossein Zade+2 more|arXiv (Cornell University)|Sep 8, 2017

Internet Traffic Analysis and Secure E-voting115 citations

TL;DR

Deep Packet uses a CNN and a stacked autoencoder to perform both application identification and traffic characterization on encrypted traffic, achieving state-of-the-art results on the ISCX VPN-nonVPN dataset.

ABSTRACT

Internet traffic classification has become more important with rapid growth of current Internet network and online applications. There have been numerous studies on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a \\emph{deep learning} based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both \\emph{traffic characterization} in which the network traffic is categorized into major classes (\\eg, FTP and P2P) and application identification in which end-user applications (\\eg, BitTorrent and Skype) identification is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. After an initial pre-processing phase on data, packets are fed into Deep Packet framework that embeds stacked autoencoder and convolution neural network in order to classify network traffic. Deep packet with CNN as its classification model achieved recall of $0.98$ in application identification task and $0.94$ in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.

Motivation & Objective

• Address the challenge of classifying encrypted network traffic without manual feature engineering.
• Develop a unified deep learning framework that handles both application identification and traffic characterization.
• Demonstrate the ability to distinguish VPN vs non-VPN traffic and identify end-user applications.
• Evaluate performance on the ISCX VPN-nonVPN dataset and compare with prior methods.

Proposed method

• Pre-process packet data by removing Ethernet headers, normalizing payloads to a fixed 1500-byte input, and masking IP addresses.
• Use two deep learning architectures: a one-dimensional CNN for feature extraction and a stacked autoencoder (SAE) for unsupervised feature learning followed by softmax classification.
• Train SAE with greedy layer-wise pre-training and fine-tuning; apply dropout and batch normalization to prevent over-fitting.
• Train a CNN with two convolutional layers, pooling, and a three-layer fully connected network with dropout, followed by softmax classification.
• Evaluate using recall, precision, and F1-score; perform grid search over CNN hyperparameters to balance accuracy and model complexity.

Experimental results

Research questions

• RQ1 Can deep learning automatically extract discriminative features from packet-level data for traffic classification without manual feature engineering?
• RQ2 Can Deep Packet jointly perform application identification and traffic characterization on encrypted traffic including VPN and non-VPN scenarios?
• RQ3 How do CNN and SAE compare in terms of accuracy for encrypted traffic classification on the ISCX VPN-nonVPN dataset?
• RQ4 Does the model effectively distinguish P2P and other challenging applications under protocol obfuscation and encryption?

Key findings

• CNN achieved a weighted average F1 of 0.98 for application identification and 0.93 for traffic characterization on the ISCX VPN-nonVPN dataset.
• SAE achieved a weighted average F1 of 0.95 for application identification and 0.92 for traffic characterization.
• On the application identification task, the models achieved near-perfect performance for several classes (e.g., Netflix, Torrent, YouTube, etc.).
• On the traffic characterization task, most classes reached high recall and precision, with CNN often matching or exceeding SAE.
• The study reports that Deep Packet outperforms prior methods on the same dataset for both tasks, highlighting the advantage of packet-level deep learning over hand-crafted flow features.