Neural network-based encrypted traffic classification and application categorization framework for the tor network

Abstract

Traffic classification can be useful in network monitoring, quality-of-service management, and intrusion detection. Recently, the number/types of applications have grown and new protocols are required. Conventional traffic classification methods do not adapt effectively, and the problem becomes more severe for encrypted traffic. Operators must encrypt most network traffic due to increased demand for user privacy. This paper proposes a deep learning (DL)–based encrypted traffic categorization and application service classification method. Two well-known neural networks, namely a deep neural network (DNN) and convolutional neural network (CNN), are implemented for classification while considering temporal features. We study the performance of DL models with various feature selection methods (FSM) and different TCP traffic flow timeouts. We propose use case scenario for encrypted traffic classification in a software-defined wireless network (SDWN). The results indicate DNN model using information gain (IG), and a TCP timeout of 60 s provides an accuracy of 100% and a generalization gap (GG) of 0.001 in the training phase, for encrypted and benign traffic classification. Testing accuracy and loss of 99.9% and 0.01, respectively, are achieved. In the CNN model using correlation (Corr), a TCP timeout of 120 s has accuracy of 90% and a GG of 0.7 in the training phase. Testing an accuracy and a loss up to 84.2% and 0.81, respectively, is achieved. Execution timesteps of 30 and 220µs are estimated for traffic categorization and application service classification. Compared to existing work, the DL model shows improvements of up to 86%, 64%, and 21% in F1-score, precision, and recall values, respectively. The source code is available at github repository: https://github.com/tmahboob/ToR-Traffic-Classification-using-Neural-Networks.