DenTC: An expandable framework for dynamic malicious traffic classification

Abstract

Malicious traffic classification is crucial for network security and the identification of malicious network activities. Currently, deep learning (DL)-based traffic classification techniques primarily learn features from static traffic datasets. However, network traffic is dynamic and constantly evolving, with new traffic types continuously emerging. This makes it difficult for existing static DL-based methods to meet the demands of dynamic traffic classification. On one hand, fine-tuning existing DL-based models with newly arrived data leads to catastrophic forgetting of previously learned knowledge; on the other hand, retraining the entire model using all available data introduces high data dependency. To circumvent these issues, we propose DenTC, a novel expandable framework for dynamic malicious traffic classification. DenTC offers three key advantages: (i) it incrementally learns from dynamic traffic without requiring retraining of the entire model; (ii) it mitigates catastrophic forgetting of past knowledge, achieving accurate and stable performance; and (iii) it minimizes data dependency, eliminating the need to store all old data. Unlike existing methods, we construct a dynamically expandable module that freezes the previously learned representation while extending new feature extractors to acquire new knowledge. To further reinforce the retention of past knowledge, a subset of representative samples from old classes is selected for subsequent training. To better learn discriminative features for new classes, we introduce an auxiliary loss function to the new feature extractor. Additionally, we employ weight alignment to correct the weights biased toward new classes. Trace-driven experiments show that DenTC maintains high and stable performance while incrementally learning dynamic network traffic, outperforming existing methods.