Survey of research on encrypted traffic classification based on machine learning

FU Yu; LIU Taotao; WANG Kun; YU Yihan

doi:10.11959/j.issn.1000-436x.2025006

您当前的位置：

首页 >

文章列表页 >

Survey of research on encrypted traffic classification based on machine learning

Comprehensive Reviews | 更新时间：2025-02-13

- Survey of research on encrypted traffic classification based on machine learning
- Journal on Communications Vol. 46, Issue 1, Pages: 167-191(2025)
- 作者机构：
  
  1.海军工程大学信息安全系，湖北武汉 430033
  2.信阳职业技术学院数学与信息工程学院，河南信阳 464000
  3.海军工程大学作战运筹与规划系，湖北武汉 430033
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62102422);Henan Province Key Science and Technology Research Projects of China(242102211070)
- DOI：10.11959/j.issn.1000-436x.2025006
  CLC： TP393
- Received：29 September 2024，
  
  Revised：2024-12-13，
  
  Published：25 January 2025
- 稿件说明：
移动端阅览
付钰,刘涛涛,王坤等.基于机器学习的加密流量分类研究综述[J].通信学报,2025,46(01):167-191.

FU Yu,LIU Taotao,WANG Kun,et al.Survey of research on encrypted traffic classification based on machine learning[J].Journal on Communications,2025,46(01):167-191.
付钰,刘涛涛,王坤等.基于机器学习的加密流量分类研究综述[J].通信学报,2025,46(01):167-191. DOI： 10.11959/j.issn.1000-436x.2025006.

FU Yu,LIU Taotao,WANG Kun,et al.Survey of research on encrypted traffic classification based on machine learning[J].Journal on Communications,2025,46(01):167-191. DOI： 10.11959/j.issn.1000-436x.2025006.

摘要

加密流量分类是网络管理和安全防护的重要组成部分，不过当前网络流量环境复杂多变，致使传统的分类方法已基本失效。而机器学习，尤其是深度学习，凭借强大的特征提取能力已广泛应用于加密流量分类领域。为此，对机器学习驱动的加密流量分类最新成果进行系统性综述，首先将加密流量分类工作划分为数据采集与处理、特征提取与选择及流量分类与性能评估3个部分，分别对应加密流量分类中的数据获取、显著特征构建及模型的应用与验证；接着将这3个部分内容细分为流量采集、数据集构建、数据预处理、特征提取、特征选择、分类模型及性能评估7个阶段；然后分别对这7个阶段进行全面的归纳、总结与分析；最后详细分析当前工作所面临的挑战并展望加密流量分类未来的研究方向。

Abstract

Encrypted traffic classification was an important component of network management and security protection. However

the complexity and variability of the current network traffic environment rendered traditional classification methods largely ineffective. Machine learning

particularly deep learning

with its strong feature extraction capabilities

has been widely used in the field of encrypted traffic classification. To this end

a systematic review of the latest advancements in machine learning-driven encrypted traffic classification was provided. Firstly

the encrypted traffic classification work was roughly divided into three parts: data collection and processing

feature extraction and selection

and traffic classification and performance evaluation

which correspond to data acquisition

significant feature construction

and model application and validation in encrypted traffic classification. The content was further subdivided into seven stages: traffic collection

dataset construction

data preprocessing

feature extraction

feature selection

classification models

and performance evaluation. A comprehensive summary

synthesis

and analysis of these seven stages were then conducted. Finally

the challenges faced by current research were analyzed in detail

and the future research directions for encrypted traffic classification were prospected.

关键词

Keywords

references

陈子涵 , 程光 , 徐子恒 , 等 . 互联网加密流量检测、分类与识别研究综述 [J ] . 计算机学报 , 2023 , 46 ( 5 ): 1060 - 1085 .

CHEN Z H , CHENG G , XU Z H , et al . A survey on Internet encrypted traffic detection, classification and identification [J ] . Chinese Journal of Computers , 2023 , 46 ( 5 ): 1060 - 1085 .

CHEN Z H , CHENG G , NIU D D , et al . WFF-EGNN: encrypted traffic classification based on weaved flow fragment via ensemble graph neural networks [J ] . IEEE Transactions on Machine Learning in Communications and Networking , 2023 , 1 : 389 - 411 .

WU D M , DENG Y , LI M Y . FL-MGVN: Federated learning for anomaly detection using mixed Gaussian variational self-encoding network [J ] . Information Processing & Management , 2022 , 59 ( 2 ): 102839 .

AN P , WANG Z Y , ZHANG C J . Ensemble unsupervised autoencoders and Gaussian mixture model for cyberattack detection [J ] . Information Processing & Management , 2022 , 59 ( 2 ): 102844 .

D’ANGELO G , CASTIGLIONE A , PALMIERI F . DNS tunnels detection via DNS-images [J ] . Information Processing & Management , 2022 , 59 ( 3 ): 102930 .

WANG W L , WANG Y J , DUAN P Y , et al . A triple real-time trajectory privacy protection mechanism based on edge computing and blockchain in mobile crowdsourcing [J ] . IEEE Transactions on Mobile Computing , 2023 , 22 ( 10 ): 5625 - 5642 .

HUANG Y , LI W , WANG J B , et al . Privacy protection among three antithetic-parties for context-aware services [J ] . Journal of Network and Computer Applications , 2021 , 191 : 103115 .

Google . Google transparency report [R ] . 2022 .

ENCRYPT L . Percentage of web pages loaded by firefox using HTTPS [R ] . 2023 .

R&S . Protocol and application classification with metadata extraction (PACE2) [R ] . 2017 .

Cisco . Network based application recognition(MBAR) [R ] . 2017 .

Ntop . Open and extensible LGPLv3 deep packet inspection library (nDPI) [R ] . 2017 .

L7-filter. L7-filter sourcecode (17-filter) [R ] . 2017 .

MARTIN R . Network intrusion detection & prevention system (Snort) [R ] . 2017 .

侯剑 , 鲁辉 , 刘方爱 , 等 . 加密恶意流量检测及对抗综述 [J ] . 软件学报 , 2024 , 35 ( 1 ): 333 - 355 .

HOU J , LU H , LIU F A , et al . Detection and countermeasure of encrypted malicious traffic: a survey [J ] . Journal of Software , 2024 , 35 ( 1 ): 333 - 355 .

VELAN P , ČERMÁK M , ČELEDA P , et al . A survey of methods for encrypted traffic classification and analysis [J ] . International Journal of Network Management , 2015 , 25 ( 5 ): 355 - 374 .

SHEN M , YE K , LIU X T , et al . Machine learning-powered encrypted network traffic analysis: a comprehensive survey [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 1 ): 791 - 824 .

于治平 , 刘彩霞 , 刘树新 , 等 . 基于机器学习的网络流量分类综述 [J ] . 信息工程大学学报 , 2023 , 24 ( 4 ): 447 - 453, 483 .

YU Z P , LIU C X , LIU S X , et al . Overview of network traffic classification based on machine learning [J ] . Journal of Information Engineering University , 2023 , 24 ( 4 ): 447 - 453, 483 .

REZAEI S , LIU X . Deep learning for encrypted traffic classification: an overview [J ] . IEEE Communications Magazine , 2019 , 57 ( 5 ): 76 - 81 .

郭宇斌 , 李航 , 丁建伟 . 基于深度学习的加密流量识别研究综述及展望 [J ] . 通信技术 , 2021 , 54 ( 9 ): 2074 - 2079 .

GUO Y B , LI H , DING J W . Review and perspective on encrypted traffic identification using deep learning [J ] . Communications Technology , 2021 , 54 ( 9 ): 2074 - 2079 .

HENDAOUI F , FERCHICHI A , TRABELSI L , et al . Advances in deep learning intrusion detection over encrypted data with privacy preservation: a systematic review [J ] . Cluster Computing , 2024 , 27 ( 7 ): 8683 - 8724 .

RESCORLA E . SSL and TLS: designing and building secure systems [R ] . 2001 .

BHIOGADE M S . Secure socket layer [C ] // Proceedings of the Computer Science and Information Technology Education Conference . Piscataway : IEEE Press , 2002 : 85 - 90 .

LANGLEY A , RIDDOCH A , WILK A , et al . The QUIC transport protocol [C ] // Proceedings of the Conference of the ACM Special Interest Group on Data Communication . New York : ACM Press , 2017 : 183 - 196 .

YLONEN T , LONVICK C . The secure shell (SSH) protocol architecture [R ] . 2006 .

FRANKEL S . Demystifying the IPsec puzzle [M ] . Boston : Artech House , 2001 .

付钰 , 王坤 , 段雪源 , 等 . 面向软件定义网络的异常流量检测研究综述 [J ] . 通信学报 , 2024 , 45 ( 3 ): 208 - 226 .

FU Y , WANG K , DUAN X Y , et al . Survey of research on abnormal traffic detection for software defined networks [J ] . Journal on Communications , 2024 , 45 ( 3 ): 208 - 226 .

WANG K , FU Y , DUAN X Y , et al . Abnormal traffic detection system in SDN based on deep learning hybrid models [J ] . Computer Communications , 2024 , 216 : 183 - 194 .

CHAPPELL L . Wireshark network analysis [M ] . Laura : Laura Chappell University , 2012 .

TIWARI A , SARASWAT S , DIXIT U , et al . Refinements in Zeek intrusion detection system [C ] // Proceedings of the 2022 8th International Conference on Advanced Computing and Communication Systems (ICACCS) . Piscataway : IEEE Press , 2022 : 974 - 979 .

BONELLI N , GIORDANO S , PROCISSI G . Enabling packet fan-out in the Libpcap library for parallel traffic processing [C ] // Proceedings of the 2017 Network Traffic Measurement and Analysis Conference (TMA) . Piscataway : IEEE Press , 2017 : 1 - 9 .

GOYAL P , GOYAL A . Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark [C ] // Proceedings of the 2017 9th International Conference on Computational Intelligence and Communication Networks (CICN) . Piscataway : IEEE Press , 2017 : 77 - 81 .

HOFSTEDE R , ČELEDA P , TRAMMELL B , et al . Flow monitoring explained: from packet capture to data analysis with Netflow and IPFIX [J ] . IEEE Communications Surveys & Tutorials , 2014 , 16 ( 4 ): 2037 - 2064 .

UJJAN R M A , PERVEZ Z , DAHAL K , et al . Towards Sflow and adaptive polling sampling for deep learning based DDoS detection in SDN [J ] . Future Generation Computer Systems , 2020 , 111 : 763 - 779 .

王伟 . 基于深度学习的网络流量分类及异常检测方法研究 [D ] . 合肥 : 中国科学技术大学 , 2018 .

WANG W . Research on network traffic classification and anomaly detection method based on deep learning [D ] . Hefei : University of Science and Technology of China , 2018 .

WANG W , ZHU M , WANG J L , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . Piscataway : IEEE Press , 2017 : 43 - 48 .

WANG W , ZHU M , ZENG X W , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // Proceedings of the 2017 International Conference on Information Networking (ICOIN) . Piscataway : IEEE Press , 2017 : 712 - 717 .

BADER O , LICHY A , HAJAJ C , et al . MalDIST: from encrypted traffic classification to malware traffic detection and classification [C ] // Proceedings of the 2022 IEEE 19th Annual Consumer Communications & Networking Conference (CCNC) . Piscataway : IEEE Press , 2022 : 527 - 533 .

DRAPER-GIL G , LASHKARI A H , MAMUN M S I , et al . Characterization of encrypted and VPN traffic using time-related features [C ] // Proceedings of the 2nd International Conference on Information Systems Security and Privacy . Piscataway : IEEE Press , 2016 : 407 - 414 .

ZHANG H Z , YU L , XIAO X , et al . TFE-GNN: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2023 . New York : ACM Press , 2023 : 2066 - 2075 .

ACETO G , CIUONZO D , MONTIERI A , et al . DISTILLER: encrypted traffic classification via multimodal multitask deep learning [J ] . Journal of Network and Computer Applications , 2021 , 183 : 102985 .

ZHANG H Z , XIAO X , YU L , et al . One train for two tasks: an encrypted traffic classification framework using supervised contrastive learning [J ] . arXiv Preprint , arXiv: 2402.07501 , 2024 .

LASHKARI A H , GIL G D , MAMUN M S I , et al . Characterization of tor traffic using time based features [C ] // Proceedings of the 3rd International Conference on Information Systems Security and Privacy . Piscataway : IEEE Press , 2017 : 253 - 262 .

HAN X B , XU G Z , ZHANG M , et al . DE-GNN: dual embedding with graph neural network for fine-grained encrypted traffic classification [J ] . Computer Networks , 2024 , 245 : 110372 .

LI Y , CHEN X S , TANG W Y , et al . Interaction matters: encrypted traffic classification via status-based interactive behavior graph [J ] . Applied Soft Computing , 2024 , 155 : 111423 .

GARCÍA S , GRILL M , STIBOREK J , et al . An empirical comparison of botnet detection methods [J ] . Computers & Security , 2014 , 45 : 100 - 123 .

HONG Y P , LI Q , YANG Y Q , et al . Graph based encrypted malicious traffic detection with hybrid analysis of multi-view features [J ] . Information Sciences , 2023 , 644 : 119229 .

SHEKHAWAT A S , DI TROIA F , STAMP M . Feature analysis of encrypted malicious traffic [J ] . Expert Systems with Applications , 2019 , 125 : 130 - 141 .

MUEHLSTEIN J , ZION Y , BAHUMI M , et al . Analyzing HTTPS encrypted traffic to identify user’s operating system, browser and application [C ] // Proceedings of the 2017 14th IEEE Annual Consumer Communications & Networking Conference (CCNC) . Piscataway : IEEE Press , 2017 : 1 - 6 .

YANG Z J , LIN W . Unknown traffic identification based on deep adaptation networks [C ] // Proceedings of the 2020 IEEE 45th LCN Symposium on Emerging Topics in Networking (LCN Symposium) . Piscataway : IEEE Press , 2020 : 10 - 18 .

REZAEI S , LIU X . How to achieve high classification accuracy with just a few labels: a semi-supervised approach using sampled packets [J ] . arXiv Preprint , arXiv: 1812.09761 , 2018 .

MOUSTAFA N , SLAY J . UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) [C ] // Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS) . Piscataway : IEEE Press , 2015 : 1 - 6 .

SONG J M , WANG X J , HE M S , et al . CSK-CNN: network intrusion detection model based on two-layer convolution neural network for handling imbalanced dataset [J ] . Information , 2023 , 14 ( 2 ): 130 .

DING Z X , ZHONG G Q , QIN X P , et al . MF-Net: multi-frequency intrusion detection network for Internet traffic data [J ] . Pattern Recognition , 2024 , 146 : 109999 .

DHANABAL L , SHANTHARAJAH S P . A study on NSL-KDD dataset for intrusion detection system based on classification algorithms [J ] . International Journal of Advanced Research in Computer and Communication Engineering , 2015 , 4 ( 6 ): 446 - 452 .

LIU T T , FU Y , WANG K , et al . A multiscale approach for network intrusion detection based on variance–covariance subspace distance and EQL v2 [J ] . Computers & Security , 2025 , 148 : 104173 .

SHARAFALDIN I , HABIBI LASHKARI A , GHORBANI A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // Proceedings of the 4th International Conference on Information Systems Security and Privacy . Piscataway : IEEE Press , 2018 : 108 - 116 .

WANG Z D , LI Z Y , HE D J , et al . A lightweight approach for network intrusion detection in industrial cyber-physical systems based on knowledge distillation and deep metric learning [J ] . Expert Systems with Applications , 2022 , 206 : 117671 .

DIAO Z L , XIE G G , WANG X , et al . EC-GCN: a encrypted traffic classification framework based on multi-scale graph convolution networks [J ] . Computer Networks , 2023 , 224 : 109614 .

YUN X C , WANG Y P , ZHANG Y Z , et al . Encrypted TLS traffic classification on cloud platforms [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 1 ): 164 - 177 .

LOTFOLLAHI M , SIAVOSHANI M J , ZADE R S H , et al . Deep packet: a novel approach for encrypted traffic classification using deep learning [J ] . Soft Computing , 2020 , 24 ( 3 ): 1999 - 2012 .

HASIBI R , SHOKRI M , DEHGHAN M . Augmentation scheme for dealing with imbalanced network traffic classification using deep learning [J ] . arXiv Preprint , arXiv: 1901.00204 , 2019 .

WANG P , LI S H , YE F , et al . PacketCGAN: exploratory study of class imbalance for encrypted traffic classification using CGAN [C ] // Proceedings of the ICC 2020 - 2020 IEEE International Conference on Communications (ICC) . Piscataway : IEEE Press , 2020 : 1 - 7 .

VU L , BUI C T , NGUYEN Q U , et al . A deep learning based method for handling imbalanced problem in network traffic classification [C ] // Proceedings of the 8th International Symposium on Information and Communication Technology . New York : ACM Press , 2017 : 333 - 339 .

ZHU S Z , XU X L , GAO H H , et al . CMTSNN: a deep learning model for multiclassification of abnormal and encrypted traffic of Internet of Things [J ] . IEEE Internet of Things Journal , 2023 , 10 ( 13 ): 11773 - 11791 .

TELIKANI A , GANDOMI A H , CHOO K R , et al . A cost-sensitive deep learning-based approach for network traffic classification [J ] . IEEE Transactions on Network and Service Management , 2022 , 19 ( 1 ): 661 - 670 .

ZHOU N , WANG Q , ZHOU J X . IoT unbalanced traffic classification system based on Focal_Attention_LSTM [C ] // Proceedings of the 2021 IEEE 5th Information Technology, Networking, Electronic and Automation Control Conference (ITNEC) . Piscataway : IEEE Press , 2021 : 899 - 903 .

XU L Y , ZHOU X , LIN X F , et al . A new loss function for traffic classification task on dramatic imbalanced datasets [C ] // Proceedings of the ICC 2020 - 2020 IEEE International Conference on Communications (ICC) . Piscataway : IEEE Press , 2020 : 1 - 7 .

MCGREW D , ANDERSON B . Enhanced telemetry for encrypted threat analytics [C ] // Proceedings of the 2016 IEEE 24th International Conference on Network Protocols (ICNP) . Piscataway : IEEE Press , 2016 : 1 - 6 .

秦鸣乐 . 基于TLS的恶意加密流量识别研究 [D ] . 乌鲁木齐 : 新疆师范大学 , 2022 .

QIN M L . Research on identification of malicious encrypted traffic based on TLS [D ] . Urumqi : Xinjiang Normal University , 2022 .

姜鹏 . APT攻击下的C&C加密信道网络行为分析与检测 [D ] . 上海 : 上海师范大学 , 2018 .

JIANG P . Analysis and detection of network behavior of C&C encrypted channel under APT attack [D ] . Shanghai : Shanghai Normal University , 2018 .

霍跃华 , 吴文昊 , 赵法起 , 等 . 结合协同训练的多视图加密恶意流量检测方法 [J ] . 西安电子科技大学学报 , 2023 , 50 ( 4 ): 139 - 147 .

HUO Y H , WU W H , ZHAO F Q , et al . Multi-view encryption malicious traffic detection method combined with co-training [J ] . Journal of Xidian University , 2023 , 50 ( 4 ): 139 - 147 .

汪洋 , 梁丁 , 查志成 , 等 . 一种基于测速行为的VPN服务器节点识别 [J ] . 网络空间安全科学学报 , 2023 ( 3 ): 59 - 67 .

WANG Y , LIANG D , ZHA Z C , et al . Traffic identification for VPN nodes based on velocity measurement behavior [J ] . Journal of Cybersecurity , 2023 ( 3 ): 59 - 67 .

AKBARI I , SALAHUDDIN M A , VEN L , et al . A look behind the curtain: traffic classification in an increasingly encrypted web [J ] . Proceedings of the ACM on Measurement and Analysis of Computing Systems , 2021 , 5 ( 1 ): 1 - 26 .

LUXEMBURK J , TOMÁŠ Č . Fine-grained TLS services classification with reject option [J ] . Computer Networks , 2023 , 220 : 109467 .

周益旻 , 刘方正 , 王勇 . 基于混合方法的IPSec VPN加密流量识别 [J ] . 计算机科学 , 2021 , 48 ( 4 ): 295 - 302 .

ZHOU Y M , LIU F Z , WANG Y . IPSec VPN encrypted traffic identification based on hybrid method [J ] . Computer Science , 2021 , 48 ( 4 ): 295 - 302 .

CHEN Y G , ZANG T N , ZHANG Y Z , et al . Rethinking encrypted traffic classification: a multi-attribute associated fingerprint approach [C ] // Proceedings of the 2019 IEEE 27th International Conference on Network Protocols (ICNP) . Piscataway : IEEE Press , 2019 : 1 - 11 .

LIU J Y , ZENG Y Z , SHI J Y , et al . MalDetect: a structure of encrypted malware traffic detection [J ] . Computers , Materials & Continua, 2019 , 60 ( 2 ): 721 - 739 .

YAO H P , LIU C , ZHANG P Y , et al . Identification of encrypted traffic through attention mechanism based long short term memory [J ] . IEEE Transactions on Big Data , 2022 , 8 ( 1 ): 241 - 252 .

SHEN M , LIU Y T , ZHU L H , et al . Fine-grained webpage fingerprinting using only packet length information of encrypted traffic [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 16 : 2046 - 2059 .

孙云霄 , 李军 , 王佰玲 . 基于侧信道特征的IPSec VPN闭合性检测方法 [J ] . 计算机科学 , 2023 , 50 ( 10 ): 308 - 314 .

SUN Y X , LI J , WANG B L . IPSec VPN closure detection method based on side-channel features [J ] . Computer Science , 2023 , 50 ( 10 ): 308 - 314 .

HE H J , LAI Y X , WANG Y P , et al . A data skew-based unknown traffic classification approach for TLS applications [J ] . Future Generation Computer Systems , 2023 , 138 : 1 - 12 .

KOUMAR J , HYNEK K , ČEJKA T . Network traffic classification based on single flow time series analysis [C ] // Proceedings of the 2023 19th International Conference on Network and Service Management (CNSM) . Piscataway : IEEE Press , 2023 : 1 - 7 .

LONG G , ZHANG Z X . Deep encrypted traffic detection: an anomaly detection framework for encryption traffic based on parallel automatic feature extraction [J ] . Computational Intelligence and Neuroscience , 2023 , 2023 ( 1 ): 3316642 .

ZHANG J L , LI F H , YE F , et al . Autonomous unknown-application filtering and labeling for DL-based traffic classifier update [C ] // Proceedings of the IEEE INFOCOM 2020 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2020 : 397 - 405 .

ZOU Z , GE J G , ZHENG H B , et al . Encrypted traffic classification with a convolutional long short-term memory neural network [C ] // Proceedings of the 2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS) . Piscataway : IEEE Press , 2018 : 329 - 334 .

MARÍN G , CAASAS P , CAPDEHOURAT G . Deepmal-deep learning models for malware traffic detection and classification [C ] // Proceedings of the 3rd International Data Science Conference . Berlin : Springer , 2021 : 105 - 112 .

李郅琴 , 杜建强 , 聂斌 , 等 . 特征选择方法综述 [J ] . 计算机工程与应用 , 2019 , 55 ( 24 ): 10 - 19 .

LI Z Q , DU J Q , NIE B , et al . Summary of feature selection methods [J ] . Computer Engineering and Applications , 2019 , 55 ( 24 ): 10 - 19 .

刘涛涛 , 付钰 , 王坤 , 等 . 基于VAE-CWGAN和特征统计重要性融合的网络入侵检测方法 [J ] . 通信学报 , 2024 , 45 ( 2 ): 54 - 67 .

LIU T T , FU Y , WANG K , et al . Network intrusion detection method based on VAE-CWGAN and fusion of statistical importance of feature [J ] . Journal on Communications , 2024 , 45 ( 2 ): 54 - 67 .

DONG Y N , CAO R L , ZHANG M . A multi-objective evolutionary algorithm for multimedia traffic classification [C ] // Proceedings of the 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems (HPCC/SmartCity/DSS) . Piscataway : IEEE Press , 2019 : 2804 - 2810 .

MANJU N , HARISH B S , et al . Ensemble feature selection and classification of Internet traffic using XGBoost classifier [J ] . International Journal of Computer Network and Information Security , 2019 , 11 ( 7 ): 37 - 44 .

MCGAUGHEY D , SEMENIUK T , SMITH R , et al . A systematic approach of feature selection for encrypted network traffic classification [C ] // Proceedings of the 2018 Annual IEEE International Systems Conference (SysCon) . Piscataway : IEEE Press , 2018 : 1 - 8 .

AL-GARADI M A , MOHAMED A , AL-ALI A K , et al . A survey of machine and deep learning methods for Internet of Things (IoT) security [J ] . IEEE Communications Surveys & Tutorials , 2020 , 22 ( 3 ): 1646 - 1685 .

KOTSIOPOULOS T , SARIGIANNIDIS P , IOANNIDIS D , et al . Machine learning and deep learning in smart manufacturing: the smart grid paradigm [J ] . Computer Science Review , 2021 , 40 : 100341 .

SHINDE P P , SHAH S . A review of machine learning and deep learning applications [C ] // Proceedings of the 2018 Fourth International Conference on Computing Communication Control and Automation (ICCUBEA) . Piscataway : IEEE Press , 2018 : 1 - 6 .

XIN Y , KONG L S , LIU Z , et al . Machine learning and deep learning methods for cybersecurity [J ] . IEEE Access , 2018 , 6 : 35365 - 35381 .

HULAYYIL S B , LI S C , XU L D . Machine-learning-based vulnerability detection and classification in Internet of Things device security [J ] . Electronics , 2023 , 12 ( 18 ): 3927 .

ALSHAMMARI R , ZINCIR-HEYWOOD A N . Can encrypted traffic be identified without port numbers, IP addresses and payload inspection? [J ] . Computer Networks , 2011 , 55 ( 6 ): 1326 - 1350 .

ZAKI F , AFIFI F , ABD RAZAK S , et al . GRAIN: Granular multi-label encrypted traffic classification using classifier chain [J ] . Computer Networks , 2022 , 213 : 109084 .

HE Y Z , HU L P , GAO R . Detection of tor traffic hiding under Obfs4 protocol based on two-level filtering [C ] // Proceedings of the 2019 2nd International Conference on Data Intelligence and Security (ICDIS) . Piscataway : IEEE Press , 2019 : 195 - 200 .

HAN S B , WU Q H , ZHANG H , et al . Light-weight unsupervised anomaly detection for encrypted malware traffic [C ] // Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) . Piscataway : IEEE Press , 2022 : 206 - 213 .

GIJÓN C , TORIL M , SOLERA M , et al . Encrypted traffic classification based on unsupervised learning in cellular radio access networks [J ] . IEEE Access , 2020 , 8 : 167252 - 167263 .

YANG L M , FU S J , LUO Y C , et al . A clustering method of encrypted video traffic based on levenshtein distance [C ] // Proceedings of the 2021 17th International Conference on Mobility, Sensing and Networking (MSN) . IEEE , 2021 : 1 - 8 .

HE G F , YANG M , LUO J Z , et al . A novel application classification attack against Tor [J ] . Concurrency and Computation: Practice and Experience , 2015 , 27 ( 18 ): 5640 - 5661 .

FU Y J , XIONG H , LU X J , et al . Service usage classification with encrypted Internet traffic in mobile messaging apps [J ] . IEEE Transactions on Mobile Computing , 2016 , 15 ( 11 ): 2851 - 2864 .

NGUYEN A T , PARK M . Detection of DoH tunneling using semi-supervised learning method [C ] // Proceedings of the 2022 International Conference on Information Networking (ICOIN) . Piscataway : IEEE Press , 2022 : 450 - 453 .

DOWLING S , SCHUKAT M , BARRETT E . Improving adaptive honeypot functionality with efficient reinforcement learning parameters for automated malware [J ] . Journal of Cyber Security Technology , 2018 , 2 ( 2 ): 75 - 91 .

GUPTA A . VPN-nonVPN traffic classification using deep reinforced naive Bayes and fuzzy K-means clustering [C ] // Proceedings of the 2021 IEEE 41st International Conference on Distributed Computing Systems Workshops (ICDCSW) . Piscataway : IEEE Press , 2021 : 1 - 6 .

ROOKARD C , KHOJANDI A . Applying deep reinforcement learning for detection of Internet-of- things cyber attacks [C ] // Proceedings of the 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC) . Piscataway : IEEE Press , 2023 : 389 - 395 .

XIE G R , LI Q , JIANG Y . Self-attentive deep learning method for online traffic classification and its interpretability [J ] . Computer Networks , 2021 , 196 : 108267 .

LIN K D , XU X L , GAO H H . TSCRNN: a novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT [J ] . Computer Networks , 2021 , 190 : 107974 .

DAI J B , XU X L , GAO H H , et al . CMFTC: cross modality fusion efficient multitask encrypt traffic classification in IIoT environment [J ] . IEEE Transactions on Network Science and Engineering , 2023 , 10 ( 6 ): 3989 - 4009 .

AOUEDI O , PIAMRAT K , BAGADTHEY D . A semi-supervised stacked autoencoder approach for network traffic classification [C ] // Proceedings of the 2020 IEEE 28th International Conference on Network Protocols (ICNP) . Piscataway : IEEE Press , 2020 : 1 - 6 .

JIN Y L , FANG J , GAO Y . SSCMT-ETC: a semi-supervised contrastive mean teacher model for encrypted traffic classification [C ] // Proceedings of the 2023 2nd International Conference on Sensing, Measurement, Communication and Internet of Things Technologies (SMC-IoT) . Piscataway : IEEE Press , 2023 : 127 - 133 .

CHEN R , LUO L L , WANG X D , et al . Knowing the unknowns: network traffic detection with open-set semi-supervised learning [J ] . Computer Networks , 2024 , 251 : 110630 .

ILIYASU A S , DENG H F . Semi-supervised encrypted traffic classification with deep convolutional generative adversarial networks [J ] . IEEE Access , 2019 , 8 : 118 - 126 .

WANG P , WANG Z X , YE F , et al . ByteSGAN: a semi-supervised generative adversarial network for encrypted traffic classification in SDN Edge Gateway [J ] . Computer Networks , 2021 , 200 : 108535 .

王攀 , 陈雪娇 . 基于堆栈式自动编码器的加密流量识别方法 [J ] . 计算机工程 , 2018 , 44 ( 11 ): 140 - 147, 153 .

WANG P , CHEN X J . SAE-based encrypted traffic identification method [J ] . Computer Engineering , 2018 , 44 ( 11 ): 140 - 147, 153 .

LIN P , YE K J , HU Y S , et al . A novel multimodal deep learning framework for encrypted traffic classification [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 3 ): 1369 - 1384 .

JANG Y , KIM N , LEE B D . Traffic classification using distributions of latent space in software-defined networks: an experimental evaluation [J ] . Engineering Applications of Artificial Intelligence , 2023 , 119 : 105736 .

BOPPANA T K , BAGADE P . GAN-AE: an unsupervised intrusion detection system for MQTT networks [J ] . Engineering Applications of Artificial Intelligence , 2023 , 119 : 105805 .

DE CARVALHO BERTOLI G , Jr ALVES PEREIRA L , SAOTOME O , et al . Generalizing intrusion detection for heterogeneous networks: a stacked-unsupervised federated learning approach [J ] . Computers & Security , 2023 , 127 : 103106 .

蒋兴翔 . 基于流量的Web攻击失陷检测与分类技术研究 [D ] . 南京 : 东南大学 , 2023 .

JIANG X X . Research on detection and classification of web attacks based on traffic [D ] . Nanjing : Southeast University , 2023 .

SHEN M , LIU Y T , ZHU L H , et al . Optimizing feature selection for efficient encrypted traffic classification: a systematic approach [J ] . IEEE Network , 2020 , 34 ( 4 ): 20 - 27 .

LU J , LIU A J , DONG F , et al . Learning under concept drift: a review [J ] . IEEE Transactions on Knowledge and Data Engineering , 2019 , 31 ( 12 ): 2346 - 2363 .

CHENG J , WU Y L , YUEPENG E , et al . MATEC: a lightweight neural network for online encrypted traffic classification [J ] . Computer Networks , 2021 , 199 : 108472 .

ABBASI M , SHAHRAKI A , TAHERKORDI A . Deep learning for network traffic monitoring and analysis (NTMA): a survey [J ] . Computer Communications , 2021 , 170 : 19 - 41 .

仝鑫 , 杨莹 , 索奇伟 , 等 . 基于机器学习的加密流量分析方法综述 [J ] . 集成技术 , 2024 , 13 ( 5 ): 74 - 92 .

TONG X , YANG Y , SUO Q W , et al . A review of encrypted traffic analysis methods based on machine learning [J ] . Integrated Technology , 2024 , 13 ( 5 ): 74 - 92 .

严如强 , 周峥 , 杨远贵 , 等 . 可解释人工智能在工业智能诊断中的挑战和机遇:归因解释 [J ] . 机械工程学报 , 2024 , 60 ( 12 ): 21 - 40 .

YAN R Q , ZHOU ZH , YANG Y G , et al . Challenges and opportunities of explainable artificial intelligence in industrial smart diagnosis: attributional explanation [J ] . Journal of Mechanical Engineering , 2024 , 60 ( 12 ): 21 - 40 .

陈彩华 , 佘程熙 , 王庆阳 . 可信机器学习综述 [J ] . 工业工程 , 2024 , 27 ( 2 ): 14 - 26 .

CHEN C H , SHE C X , WANG Q Y . A review of trustworthy machine learning [J ] . Industrial Engineering Journal , 2024 , 27 ( 2 ): 14 - 26 .

Views

3522

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Botnet detection based on generative adversarial network

Encrypted traffic classification method based on parallel traffic graph and graph neural network

Survey of IP geolocation: theory, methods, and innovative applications

Survey of industrial Internet traffic analysis technology

Fast-flucos:malicious domain name detection method for Fast-flux based on DNS traffic

Related Author

Futai ZOU

Yue TAN

Lin WANG

Yongkang JIANG

Liu Taotao

An Yishuai

LIU Xueting

TAI Wenxin

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

School of Information and Software Engineering, University of Electronic Science and Technology of China

Department of Computer Science and Engineering, The Hong Kong University of Science and Technology

Zhengzhou Aiwen Tech Co., Ltd.

Institute of Information Engineering, Chinese Academy of Sciences

AI问答

⁰