Encrypted traffic classification method based on parallel traffic graph and graph neural network

LIU Taotao; FU Yu; YU Yihan; AN Yishuai

doi:10.11959/j.issn.1000-436x.2025095

您当前的位置：

首页 >

文章列表页 >

Encrypted traffic classification method based on parallel traffic graph and graph neural network

Papers | 更新时间：2025-07-04

- Encrypted traffic classification method based on parallel traffic graph and graph neural network
- Journal on Communications Vol. 46, Issue 6, Pages: 45-59(2025)
- 作者机构：
  
  1.海军工程大学信息安全系，湖北武汉 430033
  2.海军工程大学作战运筹与规划系，湖北武汉 430033
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62102422);Henan Province Key Science and Technology Research Projects of China(242102211070)
- DOI：10.11959/j.issn.1000-436x.2025095
  CLC： TP393
- Received：10 March 2025，
  
  Revised：2025-05-19，
  
  Published：25 June 2025
- 稿件说明：
移动端阅览
刘涛涛,付钰,俞艺涵等.基于并行流量图和图神经网络的加密流量分类方法[J].通信学报,2025,46(06):45-59.

LIU Taotao,FU Yu,YU Yihan,et al.Encrypted traffic classification method based on parallel traffic graph and graph neural network[J].Journal on Communications,2025,46(06):45-59.
刘涛涛,付钰,俞艺涵等.基于并行流量图和图神经网络的加密流量分类方法[J].通信学报,2025,46(06):45-59. DOI： 10.11959/j.issn.1000-436x.2025095.

LIU Taotao,FU Yu,YU Yihan,et al.Encrypted traffic classification method based on parallel traffic graph and graph neural network[J].Journal on Communications,2025,46(06):45-59. DOI： 10.11959/j.issn.1000-436x.2025095.

摘要

针对传统加密流量分类方法受限于数据集类不平衡以及复杂网络环境下所用特征不可靠等问题，提出一种基于并行流量图和图神经网络的加密流量分类方法。首先，从数据包头部和有效负载2个角度分别构建流量图以突出二者的差异；其次，引入改进的图注意力网络提取并行流量图的有效信息；然后，利用特征交叉融合注意力模块将提取到的信息进行融合以获得更为鲁棒的特征表示；最后，通过全连接层和Softmax层进行分类。实验表明，所提方法在ISCX-VPN、ISCX-nonVPN、ISCX-Tor和ISCX-nonTor数据集上取得了较好的效果，准确率分别为96.88%、90.62%、99.24%和98.13%，有效提升了加密流量分类性能。

Abstract

Aiming at the problems of traditional encrypted traffic classification methods limited by the imbalance of dataset classes and the unreliability of the features used in complex network environments

an encrypted traffic classification method based on parallel traffic graph and graph neural network was proposed. Firstly

the traffic graphs were constructed from the packet header and payload perspectives to emphasize their differences. Then

an improved graph attention network was introduced to extract effective information from the parallel traffic graphs. Next

a feature cross-fusion attention module was used to fuse the extracted information

achieving a more robust feature representation. Finally

classification was performed using fully connected layers and a Softmax layer. Experiments show that the proposed method achieves better results on the ISCX-VPN

ISCX-nonVPN

ISCX-Tor

and ISCX-nonTor datasets

with accuracies of 96.88%

90.62%

99.24%

and 98.13%

respectively

significantly enhancing encrypted traffic classification performance.

关键词

Keywords

references

ZHAO J J , LI Q , HONG Y P , et al . MetaRockETC: adaptive encrypted traffic classification in complex network environments via time series analysis and meta-learning [J ] . IEEE Transactions on Network and Service Management , 2024 , 21 ( 2 ): 2460 - 2476 .

LIU Y , WANG X , QU B , et al . ATVITSC: A novel encrypted traffic classification method based on deep learning [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 9374 - 9389 .

ERMAN J , MAHANTI A , ARLITT M , et al . Identifying and discriminating between web and peer-to-peer traffic in the network core [C ] // Proceedings of the 16th International Conference on World Wide Web . New York : ACM Press , 2007 : 883 - 892 .

YAN H N , LI H , XIAO M C , et al . PGSM-DPI: precisely guided signature matching of deep packet inspection for traffic analysis [C ] // Proceedings of the 2019 IEEE Global Communications Conference (GLOBECOM) . Piscataway : IEEE Press , 2019 : 1 - 6 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . AppScanner: automatic fingerprinting of smartphone apps from encrypted network traffic [C ] // Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2016 : 439 - 454 .

KOUMAR J , HYNEK K , ČEJKA T . Network traffic classification based on single flow time series analysis [C ] // Proceedings of the 2023 19th International Conference on Network and Service Management (CNSM) . Piscataway : IEEE Press , 2023 : 1 - 7 .

ZAKI F , AFIFI F , ABD RAZAK S , et al . GRAIN: Granular multi-label encrypted traffic classification using classifier chain [J ] . Computer Networks , 2022 , 213 : 109084 .

SHEN M , LIU Y T , ZHU L H , et al . Fine-grained webpage fingerprin-ting using only packet length information of encrypted traffic [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 16 : 2046 - 2059 .

WANG W , ZHU M , WANG J L , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . Piscataway : IEEE Press , 2017 : 43 - 48 .

LIN K D , XU X L , GAO H H . TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT [J ] . Computer Networks , 2021 , 190 : 107974 .

WANG P , LI S H , YE F , et al . PacketCGAN: exploratory study of class imbalance for encrypted traffic classification using CGAN [C ] // Proceedings of the ICC 2020 - 2020 IEEE International Conference on Communications (ICC) . Piscataway : IEEE Press , 2020 : 1 - 7 .

VU L , VAN TRA D , NGUYEN Q U . Learning from imbalanced data for encrypted traffic identification problem [C ] // Proceedings of the Se-venth Symposium on Information and Communication Technology . New York : ACM Press , 2016 : 147 - 152 .

HAN S B , WU Q H , ZHANG H , et al . Light-weight unsupervised anomaly detection for encrypted malware traffic [C ] // Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) . Piscataway : IEEE Press , 2022 : 206 - 213 .

LIU C , HE L T , XIONG G , et al . FS-net: a flow sequence network for encrypted traffic classification [C ] // Proceedings of the IEEE INFOCOM 2019 - IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2019 : 1171 - 1179 .

LIN X J , XIONG G , GOU G P , et al . ET-BERT: a contextualized datagram representation with pre-training transformers for encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2022 . New York : ACM Press , 2022 : 633 - 642 .

SHEN M , ZHANG J P , ZHU L H , et al . Accurate decentralized application identification via encrypted traffic analysis using graph neural networks [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2367 - 2380 .

ZHANG H Z , YU L , XIAO X , et al . TFE-GNN: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2023 . New York : ACM Press , 2023 : 2066 - 2075 .

HAN X B , XU G Z , ZHANG M , et al . DE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification [J ] . Computer Networks , 2024 , 245 : 110372 .

LI Y , CHEN X S , TANG W Y , et al . Interaction matters: Encrypted traffic classification via status-based interactive behavior graph [J ] . Applied Soft Computing , 2024 , 155 : 111423 .

CUI S S , HAN X Y , HAN D Q , et al . FG-SAT: efficient flow graph for encrypted traffic classification under environment shifts [J ] . arXiv Preprint , arXiv: 2408.14122 , 2024 .

YAO L , MAO C S , LUO Y . Graph convolutional networks for text classification [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2019 , 33 ( 1 ): 7370 - 7377 .

VELIČKOVIĆ P , CUCURULL G , CASANOVA A , et al . Graph attention networks [J ] . arXiv Preprint , arXiv: 1710.10903 , 2017 .

BRODY S , ALON U , YAHAV E . How attentive are graph attention networks? [J ] . arXiv Preprint , arXiv: 2105.14491 , 2021 .

ZHAO S J , ZHANG X L , XIAO P F , et al . Exchanging dual-encoder–decoder: a new strategy for change detection with semantic guidance and spatial localization [J ] . IEEE Transactions on Geoscience and Remote Sensing , 2023 , 61 : 1 - 16 .

DRAPER-GIL G , LASHKARI A H , MAMUN M S I , et al . Characterization of encrypted and VPN traffic using time-related features [C ] // Proceedings of the 2nd International Conference on Information Systems Security and Privacy . Setúbal : SciTePress , 2016 : 407 - 414 .

HABIBI LASHKARI A , DRAPER GIL G , MAMUN M S I , et al . Characterization of tor traffic using time based features [C ] // Proceedings of the 3rd International Conference on Information Systems Security and Privacy . Setúbal : SciTePress , 2017 : 253 - 262 .

EDE T V , BORTOLAMEOTTI R , CONTINELLA A , et al . FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic [C ] // Proceedings 2020 Network and Distributed System Security Symposium . Piscataway : IEEE Press , 2020 : 27 .

SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 1928 - 1943 .

WANG X , CHEN S H , SU J S . App-net: a hybrid neural network for encrypted mobile traffic classification [C ] // Proceedings of the IEEE INFOCOM 2020 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . Piscataway : IEEE Press , 2020 : 424 - 429 .

ZHANG H , GOU G P , XIONG G , et al . Multi-granularity mobile encrypted traffic classification based on fusion features [C ] // Science of Cyber Security: Third International Conference . Berlin : Springer , 2021 : 154 - 170 .

ZHAO R J , ZHAN M W , DENG X W , et al . Yet another traffic classifier: a masked autoencoder based traffic transformer with multi-level flow representation [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Palo Alto : AAAI Press , 2023 : 5420 - 5427 .

HUOH T L , LUO Y , LI P L , et al . Flow-based encrypted network traffic classification with graph neural networks [J ] . IEEE Transactions on Network and Service Management , 2023 , 20 ( 2 ): 1224 - 1237 .

ZHANG H Z , YUE H D , XIAO X , et al . Revolutionizing encrypted traffic classification with MH-net: a multi-view heterogeneous graph model [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Palo Alto : AAAI Press , 2025 : 1048 - 1056 .

Views

1115

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly traffic detection method based on data augmentation and feature mining

Survey of research on encrypted traffic classification based on machine learning

Multi-scale aware dual path network for face detection in resource-constrained edge computing environment

Non-stationary signal combined analysis based fault diagnosis method

Review of unsupervised anomaly detection techniques for medical imaging

Related Author

LIU Taotao

WANG Kun

Qi QI

Yingxin MA

Jingyu WANG

Haifeng SUN

Jianxin LIAO

Zhe CHEN

Related Institution

School of Mathematics and Information Engineering, Xinyang Vocational and Technical College

State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications

College of Computer and Information Engineering, Hohai University

School of Engineering,Kyushu Institute of Technology,Kyushu

School of Computer Science and Engineering, Xi’an University of Technology

AI脑图

AI问答

⁰