Network Traffic Classification Model Based on Attention Mechanism and Spatiotemporal Features

Abstract

Abstract Traffic classification has been widely used in network security and network management. Previous research has focused on mapping network traffic to different non­-encrypted applications, However, there are few researches on network traffic classification of encryption applications, especially the underlying traffic of encryption application. In order to solve the above problems, this paper proposes a network encrypted traffic classification model which combines attention mechanism with spatial and temporal characteristics. The model first uses LSTM (Long Short­Term Memory) to analyze the time series of the continuous network flows and find out the time characteristics between the network flows. Secondly, CNN(Convolutional Neural Network) is used to extract the high­-order spatial features of the network flow, and then the high-­order spatial features are weighted and redistributed through the SE(Squeeze­ and­ Excitation)module to obtain the key spatial features of encrypted traffic. Finally, through the two-­stage training and learning , fast classification of network flow is achieved. The main advantages of this model are as follows: 1) the mapping relationship between network flow and corresponding labels is constructed end­-to­-end without manual extraction of network flow characteristics; 2)It has a powerful generalization ability which is able to be compatible with different types of data sets; 3) there is still a high recognition rate for encryption application and the underlying traffic of encryption application. The experimental results show that this model can be well qualified for the classification of non­-encrypted and encrypted application, moreover, greatly improves the classification accuracy of the underlying traffic of encryption application.