A Multi-Scale Feature Attention Approach to Network Traffic Classification and Its Model Explanation

• Published in: IEEE eTransactions on network and service management Vol. 19; no. 2; pp. 875 - 889
• Main Authors: Wang, Yipeng, Yun, Xiaochun, Zhang, Yongzheng, Zhao, Chen, Liu, Xin
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.06.2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Artificial neural networks; Classification; Communications traffic; Convolution; Convolutional neural networks; Deep learning; Feature extraction; Format; IP networks; network management; network security; Network traffic classification; Neural networks; Payloads; Protocols; TCP/IP (protocol); Traffic models
• ISSN: 1932-4537; 1932-4537
• DOI: 10.1109/TNSM.2022.3149933

Network traffic classification, the task of associating network traffic with their generating application protocols or applications, is valuable for the control, allocation, and management of resources in today's TCP/IP networks. In this paper, we propose Ulfar, a multi-scale feature attention approach to network traffic classification, which uses convolutional neural networks (CNN) as the building block of the deep packet analysis model. In Ulfar, we take only one packet per flow for network traffic classification. Ulfar is based on the key insight that format-related bytes appear at fixed offsets or in a specific pattern in the IP packet, and these format-related bytes are important for accurate network traffic classification. Our neural network model can automatically recover the format-related bytes by building high-level, multi-scale <inline-formula> <tex-math notation="LaTeX">{n} </tex-math></inline-formula>-gram features from raw byte sequences. In addition, at the representation learning side, we try to understand what patterns and signatures our neural network model learns from network traffic. We evaluate Ulfar using two publicly available datasets, and our experimental results show that Ulfar can conduct accurate network traffic classification. Also, we compare the results of Ulfar with four state-of-the-art approaches, and find that Ulfar has the ability to classify network traffic more accurately.