arrow
Return

Let model keep evolving: Incremental learning for encrypted traffic classification

delete2024-02-01
delete2
PRE
AI
X
Xiang Li
谢江 (Jiang Xie)
Q
Qige Song
Y
Yafei Sang *
Y
Yongzheng Zhang
S
Shuhao Li
T
Tianning Zang
DOI:10.1016/j.cose.2023.103624delete
deleteOriginal
deleteOriginal request for help
deleteShare
deleteSave
Abstract

Abstract

En 中文
Encrypted Traffic Classification (ETC) is valuable for many network management and security solutions as it provides insights into applications active on the network. However, the network environment constantly evolves, and new applications emerge in an endless stream daily, which gradually makes well-trained ETC models ineffective. The conventional approach to adapting new applications is to re-train the models on a re-formed dataset with both pre-existing and new application samples. The major limitation is that requiring redundant computing resources and sufficient storage spaces. In this work, we propose an Incremental Learning (IL) framework based on multi-view sequences fusion, MISS, to keep ETC models evolving with new applications. The key novelty of MISS is three-fold: extract cross-view information from multi-view sequences to capture sufficient knowledge; propose an exemplar selection algorithm from communication patterns to reduce redundant consumption; design a pair of branches from the learnability of parameters to mitigate accuracy loss during evolution. MISS outperforms the existing IL methods of ETC, and the state-of-the-art ETC models using the classic IL framework, on the real-world network traffic datasets, which achieves satisfactory improvements of 11.37%1' and 1.58%1'. Furthermore, we comprehensively perform incremental experiments to evaluate the evolution ability of MISS, which is able to select representative exemplars of old applications, counteract the adverse effects of homogeneous applications, and keep evolving with unknown applications.
Keywords:
Encrypted traffic classification
Evolve
Incremental learning
Multi-view sequences
Cross-view information
Exemplar selection

Journal

C
Computers and Security
IF:
5.4
Papers:
4.6K
Citations:
1.4W

Organization

U
university of chinese academy of sciences, cas
Scholars:
4.1W
Papers: 3.8W
Citations: 75
C
chinese academy of sciences
Scholars:
56.5W
Papers: 44.9W
Citations: 704