基于并行流量图和图神经网络的加密流量分类方法

刘涛涛; 付钰; 俞艺涵; 安义帅

doi:10.11959/j.issn.1000-436x.2025095

您当前的位置：

首页 >

文章列表页 >

基于并行流量图和图神经网络的加密流量分类方法

学术论文 | 更新时间：2025-07-04

- 基于并行流量图和图神经网络的加密流量分类方法
- Encrypted traffic classification method based on parallel traffic graph and graph neural network
- 通信学报 2025年46卷第6期页码：45-59
- 作者机构：
  
  1.海军工程大学信息安全系，湖北武汉 430033
  2.海军工程大学作战运筹与规划系，湖北武汉 430033
- 作者简介：
  
  [ "刘涛涛（1996- ），男，江西吉安人，海军工程大学博士生，主要研究方向为人工智能、信息处理、网络安全。" ]
  [ "付钰（1982- ），女，湖北武汉人，博士，海军工程大学教授、博士生导师，主要研究方向为信息安全、人工智能。" ]
  [ "俞艺涵（1992- ），男，浙江金华人，博士，海军工程大学讲师，主要研究方向为隐私保护、信息安全。" ]
  [ "安义帅（1997- ），男，山西忻州人，海军工程大学博士生，主要研究方向为人工智能、网络安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目(62102422);河南省科技攻关基金资助项目(242102211070)
- DOI：10.11959/j.issn.1000-436x.2025095
  中图分类号： TP393
- 收稿日期：2025-03-10，
  
  修回日期：2025-05-19，
  
  纸质出版日期：2025-06-25
- 稿件说明：
移动端阅览
刘涛涛,付钰,俞艺涵等.基于并行流量图和图神经网络的加密流量分类方法[J].通信学报,2025,46(06):45-59.

LIU Taotao,FU Yu,YU Yihan,et al.Encrypted traffic classification method based on parallel traffic graph and graph neural network[J].Journal on Communications,2025,46(06):45-59.
刘涛涛,付钰,俞艺涵等.基于并行流量图和图神经网络的加密流量分类方法[J].通信学报,2025,46(06):45-59. DOI： 10.11959/j.issn.1000-436x.2025095.

LIU Taotao,FU Yu,YU Yihan,et al.Encrypted traffic classification method based on parallel traffic graph and graph neural network[J].Journal on Communications,2025,46(06):45-59. DOI： 10.11959/j.issn.1000-436x.2025095.

摘要

针对传统加密流量分类方法受限于数据集类不平衡以及复杂网络环境下所用特征不可靠等问题，提出一种基于并行流量图和图神经网络的加密流量分类方法。首先，从数据包头部和有效负载2个角度分别构建流量图以突出二者的差异；其次，引入改进的图注意力网络提取并行流量图的有效信息；然后，利用特征交叉融合注意力模块将提取到的信息进行融合以获得更为鲁棒的特征表示；最后，通过全连接层和Softmax层进行分类。实验表明，所提方法在ISCX-VPN、ISCX-nonVPN、ISCX-Tor和ISCX-nonTor数据集上取得了较好的效果，准确率分别为96.88%、90.62%、99.24%和98.13%，有效提升了加密流量分类性能。

Abstract

Aiming at the problems of traditional encrypted traffic classification methods limited by the imbalance of dataset classes and the unreliability of the features used in complex network environments

an encrypted traffic classification method based on parallel traffic graph and graph neural network was proposed. Firstly

the traffic graphs were constructed from the packet header and payload perspectives to emphasize their differences. Then

an improved graph attention network was introduced to extract effective information from the parallel traffic graphs. Next

a feature cross-fusion attention module was used to fuse the extracted information

achieving a more robust feature representation. Finally

classification was performed using fully connected layers and a Softmax layer. Experiments show that the proposed method achieves better results on the ISCX-VPN

ISCX-nonVPN

ISCX-Tor

and ISCX-nonTor datasets

with accuracies of 96.88%

90.62%

99.24%

and 98.13%

respectively

significantly enhancing encrypted traffic classification performance.

关键词

Keywords

references

ZHAO J J , LI Q , HONG Y P , et al . MetaRockETC: adaptive encrypted traffic classification in complex network environments via time series analysis and meta-learning [J ] . IEEE Transactions on Network and Service Management , 2024 , 21 ( 2 ): 2460 - 2476 .

LIU Y , WANG X , QU B , et al . ATVITSC: A novel encrypted traffic classification method based on deep learning [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 9374 - 9389 .

ERMAN J , MAHANTI A , ARLITT M , et al . Identifying and discriminating between web and peer-to-peer traffic in the network core [C ] // Proceedings of the 16th International Conference on World Wide Web . New York : ACM Press , 2007 : 883 - 892 .

YAN H N , LI H , XIAO M C , et al . PGSM-DPI: precisely guided signature matching of deep packet inspection for traffic analysis [C ] // Proceedings of the 2019 IEEE Global Communications Conference (GLOBECOM) . Piscataway : IEEE Press , 2019 : 1 - 6 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . AppScanner: automatic fingerprinting of smartphone apps from encrypted network traffic [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 439 - 454 .

KOUMAR J , HYNEK K , ČEJKA T . Network traffic classification based on single flow time series analysis [C ] // Proceedings of the 2023 19th International Conference on Network and Service Management (CNSM) . Piscataway : IEEE Press , 2023 : 1 - 7 .

ZAKI F , AFIFI F , ABD RAZAK S , et al . GRAIN: Granular multi-label encrypted traffic classification using classifier chain [J ] . Computer Networks , 2022 , 213 : 109084 .

SHEN M , LIU Y T , ZHU L H , et al . Fine-grained webpage fingerprin-ting using only packet length information of encrypted traffic [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 16 : 2046 - 2059 .

WANG W , ZHU M , WANG J L , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . Piscataway : IEEE Press , 2017 : 43 - 48 .

LIN K D , XU X L , GAO H H . TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT [J ] . Computer Networks , 2021 , 190 : 107974 .

WANG P , LI S H , YE F , et al . PacketCGAN: exploratory study of class imbalance for encrypted traffic classification using CGAN [C ] // Proceedings of the ICC 2020 - 2020 IEEE International Conference on Communications (ICC) . Piscataway : IEEE Press , 2020 : 1 - 7 .

VU L , VAN TRA D , NGUYEN Q U . Learning from imbalanced data for encrypted traffic identification problem [C ] // Proceedings of the Se-venth Symposium on Information and Communication Technology . New York : ACM Press , 2016 : 147 - 152 .

HAN S B , WU Q H , ZHANG H , et al . Light-weight unsupervised anomaly detection for encrypted malware traffic [C ] // Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) . Piscataway : IEEE Press , 2022 : 206 - 213 .

LIU C , HE L T , XIONG G , et al . FS-net: a flow sequence network for encrypted traffic classification [C ] // Proceedings of the IEEE INFOCOM 2019 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2019 : 1171 - 1179 .

LIN X J , XIONG G , GOU G P , et al . ET-BERT: a contextualized datagram representation with pre-training transformers for encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2022 . New York : ACM Press , 2022 : 633 - 642 .

SHEN M , ZHANG J P , ZHU L H , et al . Accurate decentralized application identification via encrypted traffic analysis using graph neural networks [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2367 - 2380 .

ZHANG H Z , YU L , XIAO X , et al . TFE-GNN: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2023 . New York : ACM Press , 2023 : 2066 - 2075 .

HAN X B , XU G Z , ZHANG M , et al . DE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification [J ] . Computer Networks , 2024 , 245 : 110372 .

LI Y , CHEN X S , TANG W Y , et al . Interaction matters: Encrypted traffic classification via status-based interactive behavior graph [J ] . Applied Soft Computing , 2024 , 155 : 111423 .

CUI S S , HAN X Y , HAN D Q , et al . FG-SAT: efficient flow graph for encrypted traffic classification under environment shifts [J ] . arXiv Preprint , arXiv: 2408.14122 , 2024 .

YAO L , MAO C S , LUO Y . Graph convolutional networks for text classification [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2019 , 33 ( 1 ): 7370 - 7377 .

VELIČKOVIĆ P , CUCURULL G , CASANOVA A , et al . Graph attention networks [J ] . arXiv Preprint , arXiv: 1710.10903 , 2017 .

BRODY S , ALON U , YAHAV E . How attentive are graph attention networks? [J ] . arXiv Preprint , arXiv: 2105.14491 , 2021 .

ZHAO S J , ZHANG X L , XIAO P F , et al . Exchanging dual-encoder–decoder: a new strategy for change detection with semantic guidance and spatial localization [J ] . IEEE Transactions on Geoscience and Remote Sensing , 2023 , 61 : 1 - 16 .

DRAPER-GIL G , LASHKARI A H , MAMUN M S I , et al . Characterization of encrypted and VPN traffic using time-related features [C ] // Proceedings of the 2nd International Conference on Information Systems Security and Privacy . Setúbal : SciTePress , 2016 : 407 - 414 .

HABIBI LASHKARI A , DRAPER GIL G , MAMUN M S I , et al . Characterization of tor traffic using time based features [C ] // Proceedings of the 3rd International Conference on Information Systems Security and Privacy . Setúbal : SciTePress , 2017 : 253 - 262 .

EDE T V , BORTOLAMEOTTI R , CONTINELLA A , et al . FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic [C ] // Proceedings 2020 Network and Distributed System Security Symposium . Piscataway : IEEE Press , 2020 : 27 .

SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 1928 - 1943 .

WANG X , CHEN S H , SU J S . App-net: a hybrid neural network for encrypted mobile traffic classification [C ] // Proceedings of the IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . Piscataway : IEEE Press , 2020 : 424 - 429 .

ZHANG H , GOU G P , XIONG G , et al . Multi-granularity mobile encrypted traffic classification based on fusion features [C ] // Science of Cyber Security: Third International Conference . Berlin : Springer , 2021 : 154 - 170 .

ZHAO R J , ZHAN M W , DENG X W , et al . Yet another traffic classifier: a masked autoencoder based traffic transformer with multi-level flow representation [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Palo Alto : AAAI Press , 2023 : 5420 - 5427 .

HUOH T L , LUO Y , LI P L , et al . Flow-based encrypted network traffic classification with graph neural networks [J ] . IEEE Transactions on Network and Service Management , 2023 , 20 ( 2 ): 1224 - 1237 .

ZHANG H Z , YUE H D , XIAO X , et al . Revolutionizing encrypted traffic classification with MH-net: a multi-view heterogeneous graph model [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Palo Alto : AAAI Press , 2025 : 1048 - 1056 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于机器学习的加密流量分类研究综述

面向算力受限边缘环境的双分支多尺度感知人脸检测网络

基于非平稳信号组合分析的故障诊断方法

基于双模态交叉注意力机制的智能合约漏洞检测方法

基于深度学习的通感一体化系统综述