Attention-based bidirectional GRU networks for efficient HTTPS traffic classification

• Published in: Information sciences Vol. 541; pp. 297 - 315
• Main Authors: Liu, Xun, You, Junling, Wu, Yulei, Li, Tong, Li, Liangxiong, Zhang, Zheyuan, Ge, Jingguo
• Format: Journal Article
• Language: English
• Published: Elsevier Inc 01.12.2020
• Subjects: Attention mechanism; Bidirectional gated recurrent unit; Encrypted traffic classification; HTTPS; Transfer learning; Attention mechanism; Bidirectional gated recurrent unit; HTTPS; Transfer learning; Encrypted traffic classification
• ISSN: 0020-0255; 1872-6291
• DOI: 10.1016/j.ins.2020.05.035

•A novel deep learning method for efficient HTTPS traffic classification.•Bidirectional GRU to extract forward and backward features of byte sequences.•Attention mechanism to focus on useful features for traffic classification.•Transfer learning is adopted for re-training the model quickly.•Reduce the number of parameters of the model by 7 times compared with the baseline. Distributed and pervasive web services have become a major platform for sharing information. However, the hypertext transfer protocol secure (HTTPS), which is a crucial web encryption technology for protecting the information security of users, creates a supervisory burden for network management (e.g., quality-of-service guarantees and traffic engineering). Identifying various types of encrypted traffic is crucial for cyber security and network management. In this paper, we propose a novel deep learning model called BGRUA to identify the web services running on HTTPS connections accurately. BGRUA utilizes a bidirectional gated recurrent unit (GRU) and attention mechanism to improve the accuracy of HTTPS traffic classification. The bidirectional GRU is used to extract the forward and backward features of the byte sequences in a session. The attention mechanism is adopted to assign weights to features according to their contributions to classification. Additionally, we investigate the effects of different hyperparameters on the performance of BGRUA and present a set of optimal values that can serve as a basis for future relevant studies. Comparisons to existing methods based on three typical datasets demonstrate that BGRUA outperforms state-of-the-art encrypted traffic classification approaches in terms of accuracy, precision, recall, and F1-score.