research-article

A few shots traffic classification with mini-FlowPic augmentations

Authors:

Yuval ShavittAuthors Info & Claims

IMC '22: Proceedings of the 22nd ACM Internet Measurement Conference

Pages 647 - 654

https://doi.org/10.1145/3517745.3561436

Published: 25 October 2022 Publication History

Abstract

Internet traffic classification has been intensively studied over the past decade due to its importance for traffic engineering and cyber security. One of the best solutions to several traffic classification problems is the FlowPic approach, where histograms of packet sizes in consecutive time slices are transformed into a picture that is fed into a Convolution Neural Network (CNN) model for classification.

However, CNNs (and the FlowPic approach included) require a relatively large labeled flow dataset, which is not always easy to obtain. In this paper, we show that we can overcome this obstacle by replacing the large labeled dataset with a few samples of each class and by using augmentations in order to inflate the number of training samples. We show that common picture augmentation techniques can help, but accuracy improves further when introducing augmentation techniques that mimic network behavior such as changes in the RTT.

Finally, we show that we can replace the large FlowPics suggested in the past with much smaller mini-FlowPics and achieve two advantages: improved model performance and easier engineering. Interestingly, this even improves accuracy in some cases.

Supplementary Material

M4V File (160.m4v)

Presentation video

Download
50.88 MB

References

[1]

Giuseppe Aceto, Domenico Ciuonzo, Antonio Montieri, and Antonio Pescapé. 2019. Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges. IEEE Transactions on Network and Service Management 16 (June 2019). Issue 2.

[2]

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning. PMLR, 1597--1607.

[3]

Z. Chen, K. He, J. Li, and Y. Geng. 2017. Seq2Img: A sequence-to-image based approach towards IP traffic classification using convolutional neural networks. In IEEE International Conference on Big Data (Big Data). 1271--1276.

[4]

A. Dainotti, A. Pescape, and K. C. Claffy. 2012. Issues and future directions in traffic classification. IEEE Network 26, 1 (January 2012), 35--40.

Digital Library

[5]

Gerard Draper-Gil, Arash Habibi Lashkari, Mohammad Saiful Islam Mamun, and Ali A. Ghorbani. 2016. Characterization of Encrypted and VPN Traffic using Time-related Features. In Proceedings of the 2nd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP. INSTICC, SciTePress, 407--414.

[6]

Adil Fahad, Zahir Tari, Ibrahim Khalil, Ibrahim Habib, and Hussein Alnuweiri. 2013. Toward an efficient and scalable feature selection approach for internet traffic classification. Computer Networks 57, 9 (2013), 2040 -- 2057.

Digital Library

[7]

He Huang, Haojiang Deng, Jun Chen, Luchao Han, and Wei Wang. 2018. Automatic Multi-task Learning System for Abnormal Network Traffic Detection. International Journal of Emerging Technologies in Learning 13, 4 (2018).

[8]

Ren-Hung Hwang, Min-Chun Peng, Chien-Wei Huang, Po-Ching Lin, and Van Linh Nguyen. 2020. An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection. IEEE Access 8 (2020), 30387--30399.

[9]

Auwal Sani Iliyasu and Huifang Deng. 2019. Semi-supervised encrypted traffic classification with deep convolutional generative adversarial networks. IEEE Access 8 (2019), 118--126.

[10]

Arash Habibi Lashkari, Gerard Draper Gil, Mohammad Saiful Islam Mamun, and Ali A. Ghorbani. 2017. Characterization of Tor Traffic using Time based Features. In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,. INSTICC, SciTePress, 253--262.

[11]

Sam Leroux, Steven Bohez, Pieter-Jan Maenhaut, Nathan Meheus, Pieter Simoens, and Bart Dhoedt. 2018. Fingerprinting encrypted network traffic types using machine learning. In IEEE/IFIP Network Operations and Management Symposium (NOMS). 1--5.

Digital Library

[12]

Wenhao Li, Xiao-Yu Zhang, Haichao Shi, Feng Liu, Yunlin Ma, and Zhaoxuan Li. 2020. A Glimpse of the Whole: Path Optimization Prototypical Network for Few-Shot Encrypted Traffic Classification. Technical Report. arXiv-2010 pages.

[13]

Andrew Moore, Denis Zuev, and Michael Crogan. 2005. Discriminators for use in flow-based classification. Technical Report RR-05-13. Queen Mary Uni. of London.

[14]

Tao Qin, Lei Wang, Zhaoli Liu, and Xiaohong Guan. 2015. Robust application identification methods for P2P and VoIP traffic classification in backbone networks. Knowledge-Based Systems 82 (2015), 152 -- 162.

Digital Library

[15]

Shahbaz Rezaei and Xin Liu. 2019. How to achieve high classification accuracy with just a few labels: A semi-supervised approach using sampled packets. In Industrial Conference on Data Mining (ICDM) (NYC, NY, USA).

[16]

Shahbaz Rezaei and Xin Liu. 2020. Multitask learning for network traffic classification. In 2020 29th International Conference on Computer Communications and Networks (ICCCN). IEEE, 1--9.

[17]

Sangita Roy, Tal Shapira, and Yuval Shavitt. 2022. Fast and lean encrypted Internet traffic classification. Computer Communications 186 (2022), 166--173.

Digital Library

[18]

Ola Salman, Imad H Elhajj, Ali Chehab, and Ayman Kayssi. 2019. A machine learning based framework for IoT device identification and abnormal traffic detection. Transactions on Emerging Telecommunications Technologies (2019), e3743.

[19]

Tal Shapira and Yuval Shavitt. 2019. FlowPic: Encrypted Internet Traffic Classification is as Easy as Image Recognition. In IEEE Workshop on Network Intelligence: Machine Learning for Networking (NI 2019). 680--687.

[20]

Tal Shapira and Yuval Shavitt. 2021. FlowPic: A Generic Representation for Encrypted Traffic Classification and Applications Identification. IEEE Transactions on Network and Service Management 18, 2 (2021), 1218 -- 1232.

[21]

Petr Velan, Milan Čermák, Pavel Čeleda, and Martin Drašar. 2015. A survey of methods for encrypted traffic classification and analysis. International Journal of Network Management 25, 5 (2015), 355--374.

Digital Library

[22]

Wei Wang, Ming Zhu, Xuewen Zeng, Xiaozhou Ye, and Yiqiang Sheng. 2017. Malware traffic classification using convolutional neural network for representation learning. In 2017 International conference on information networking (ICOIN). IEEE, 712--717.

[23]

Lixuan Yang, Alessandro Finamore, Feng Jun, and Dario Rossi. 2021. Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications. Technical Report 2104.03182. arXiv.

Cited By

Fu MWang PLiu MZhang ZZhou X(2025)IoV-BERT-IDS: Hybrid Network Intrusion Detection System in IoV Using Large Language ModelsIEEE Transactions on Vehicular Technology10.1109/TVT.2024.340236674:2(1909-1921)Online publication date: Feb-2025
https://doi.org/10.1109/TVT.2024.3402366
Dong WYu JLin XGou GXiong G(2025)Deep learning and pre-training technology for encrypted traffic classification: A comprehensive reviewNeurocomputing10.1016/j.neucom.2024.128444617(128444)Online publication date: Feb-2025
https://doi.org/10.1016/j.neucom.2024.128444
Horowicz EShapira TShavitt Y(2024)Self-Supervised Traffic Classification: Flow Embedding and Few-Shot SolutionsIEEE Transactions on Network and Service Management10.1109/TNSM.2024.336684821:3(3054-3067)Online publication date: Jun-2024
https://doi.org/10.1109/TNSM.2024.3366848
Show More Cited By

Recommendations

Replication: Contrastive Learning and Data Augmentation in Traffic Classification Using a Flowpic Input Representation
IMC '23: Proceedings of the 2023 ACM on Internet Measurement Conference

Over the last years we witnessed a renewed interest toward Traffic Classification (TC) captivated by the rise of Deep Learning (DL). Yet, the vast majority of TC literature lacks code artifacts, performance assessments across datasets and reference ...
A Novel Way to Generate Adversarial Network Traffic Samples against Network Traffic Classification
Network traffic classification technologies could be used by attackers to implement network monitoring and then launch traffic analysis attacks or website fingerprint attacks. In order to prevent such attacks, a novel way to generate adversarial samples ...
Traffic classification: Issues and challenges
ICNC '13: Proceedings of the 2013 International Conference on Computing, Networking and Communications (ICNC)

Traffic classification has been extensively examined in recent years, as it is widely used in network management, design, security, advertising and research. In the past few years, the traffic classification techniques have been evolved along with the ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

IMC '22: Proceedings of the 22nd ACM Internet Measurement Conference

October 2022

796 pages

ISBN:9781450392594

DOI:10.1145/3517745

General Chairs:
Chadi Barakat
Inria, Université Côte d'Azur
,
Cristel Pelsser
University of Strasbourg
,
Program Chairs:
Theophilus A. Benson
Brown University
,
David Choffnes
Northeastern University

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

In-Cooperation

USENIX Assoc: USENIX Assoc

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 October 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Qualifiers

Research-article

Conference

IMC '22

Sponsor:

IMC '22: ACM Internet Measurement Conference

October 25 - 27, 2022

Nice, France

Acceptance Rates

Overall Acceptance Rate 277 of 1,083 submissions, 26%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

11
Total Citations
View Citations
642
Total Downloads

Downloads (Last 12 months)200
Downloads (Last 6 weeks)19

Reflects downloads up to 28 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Fu MWang PLiu MZhang ZZhou X(2025)IoV-BERT-IDS: Hybrid Network Intrusion Detection System in IoV Using Large Language ModelsIEEE Transactions on Vehicular Technology10.1109/TVT.2024.340236674:2(1909-1921)Online publication date: Feb-2025
https://doi.org/10.1109/TVT.2024.3402366
Dong WYu JLin XGou GXiong G(2025)Deep learning and pre-training technology for encrypted traffic classification: A comprehensive reviewNeurocomputing10.1016/j.neucom.2024.128444617(128444)Online publication date: Feb-2025
https://doi.org/10.1016/j.neucom.2024.128444
Horowicz EShapira TShavitt Y(2024)Self-Supervised Traffic Classification: Flow Embedding and Few-Shot SolutionsIEEE Transactions on Network and Service Management10.1109/TNSM.2024.336684821:3(3054-3067)Online publication date: Jun-2024
https://doi.org/10.1109/TNSM.2024.3366848
Cai YLi SZhang HLiu YDu MFang B(2024)Fractal: Facilitating Robust Encrypted Traffic Classification Using Data Augmentation and Contrastive Learning2024 IEEE International Conference on Systems, Man, and Cybernetics (SMC)10.1109/SMC54092.2024.10831226(3076-3083)Online publication date: 6-Oct-2024
https://doi.org/10.1109/SMC54092.2024.10831226
Huang KZhou MZhang PQin XHu X(2024)Enhancing VPN Traffic Recognition Through CatBoost Feature Extraction and Stacking Ensemble LearningICC 2024 - IEEE International Conference on Communications10.1109/ICC51166.2024.10622256(79-84)Online publication date: 9-Jun-2024
https://doi.org/10.1109/ICC51166.2024.10622256
Gioacchini LSantos WLopes BDrago IMellia MAlmeida JGonçalves M(2024)Explainable Stacking Models based on Complementary Traffic Embeddings2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)10.1109/EuroSPW61312.2024.00035(261-272)Online publication date: 8-Jul-2024
https://doi.org/10.1109/EuroSPW61312.2024.00035
Hajaj CAharon PDubin RDvir A(2024)The art of time-bending: Data augmentation and early prediction for efficient traffic classificationExpert Systems with Applications10.1016/j.eswa.2024.124166252(124166)Online publication date: Oct-2024
https://doi.org/10.1016/j.eswa.2024.124166
Ma YLi ZXue HChang J(2024)A balanced supervised contrastive learning-based method for encrypted network traffic classificationComputers & Security10.1016/j.cose.2024.104023145(104023)Online publication date: Oct-2024
https://doi.org/10.1016/j.cose.2024.104023
Guarino IWang CFinamore APescapè ARossi D(2023)Many or Few Samples?: Comparing Transfer, Contrastive and Meta-Learning in Encrypted Traffic Classification2023 7th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA58422.2023.10198965(1-10)Online publication date: 26-Jun-2023
https://doi.org/10.23919/TMA58422.2023.10198965
Akbari ETahmid SMalekghaini NSalahuddin MLimam NBoutaba RMathieu BMoteau STuffin S(2023)A Critical Study of Few-Shot Learning for Encrypted Traffic Classification2023 19th International Conference on Network and Service Management (CNSM)10.23919/CNSM59352.2023.10327851(1-9)Online publication date: 30-Oct-2023
https://doi.org/10.23919/CNSM59352.2023.10327851
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten