CD-Net: Robust mobile traffic classification against apps updating

Mobile traffic classification (MTC) is an increasingly important domain in traffic filtering and malware detection. Existing methods have achieved good results in distribution-invariant MTC. However, as apps update rapidly and users’ update time varies, the traffic of a certain app often consists of multiple versions mixed together in the real-world network. This dynamic proportion of new-version app traffic significantly affects the performance of models, even if they have been retrained with new-version app traffic. In this paper, we propose CD-Net, a robust encrypted MTC method designed to classify the mixed traffic of multi-version apps. CD-Net is based on the few-shot framework and primarily comprises two components: the CNN part for feature extraction and the DNN part for classification. When an app is updated, the DNN part is retrained to classify the new-version app, while the CNN part remains unchanged to ensure the ability to classify the original-version app. We collected a real-world dataset to validate the effectiveness of our proposed CD-Net. Before retraining with the new-version app traffic, the accuracy of all models declined during the process of an app update. However, after retraining the DNN part with a few samples of the new-version app traffic, the F1-Score of our model remained above 93.68% throughout the app update process, while the F1-Score of the retrained state-of-the-art method dropped to 88.28%.