Mobile Application Encryption Traffic Classification Based On TLS Flow Sequence Network

Abstract

Traffic classification can detect the source of traffic and can be used for network management and network security. Methods based on manually extracting features and using machine learning have become mainstream. These methods have poor results in classifying applications that use standard web services, which can cause ambiguities in application classification. In this paper, we propose the TLS Flow Sequence Network (TFSN), which can automatically learn representative features from the original TLS flow sequence and complete the classification. In addition, we also used the attention mechanism to reinforce the learned features. Compared with other similar researches, we can further identify the web services corresponding to encrypted flows in detail, and are no longer limited to application classification. We conducted experiments on the real network traffic dataset of 11 types of Google applications and 9 types of Apple applications that contain the same standard web services. It shows that TFSN has excellent performance, and the accuracy of web service recognition is more than 98%.