EBSNN: Extended Byte Segment Neural Network for Network Traffic Classification
EBSNN: Extended Byte Segment Neural Network for Network Traffic Classification
复制标题
DOI：
10.1109/tdsc.2021.3101311
复制
发表时间：
2021-07
影响因子：
7.3
通讯作者：
Xi Xiao;Wentao Xiao;Rui Li;Xiapu Luo;Haitao Zheng;Shutao Xia
中科院分区：
文献类型：
--
作者：
Xi Xiao;Wentao Xiao;Rui Li;Xiapu Luo;Haitao Zheng;Shutao Xia
网络流量分类对于入侵检测和网络管理很重要。大多数现有方法基于机器学习技术，并依赖于从流或数据包手动提取的功能。但是，随着网络应用程序的快速增长，这些方法很难处理新的复杂应用程序。在本文中，我们设计了一个新颖的神经网络，即扩展的字节段神经网络（EBSNN），以对NetWrk流量进行分类。 EBSNN首先将数据包分为标头段和有效载荷段，然后将其馈入由带有注意机制的复发神经网络组成的编码器。根据输出，另一个编码器了解了整个数据包的高级表示。特别是，从标题段中学到了侧通道功能，以提高性能。最后，数据包的标签是通过SoftMax函数获得的。此外，EBSNN可以通过检查前几个数据包来对网络流进行分类。对现实世界数据集的彻底实验表明，EBSNN在应用程序识别任务和网站识别任务中的最先进方法都取得了更好的性能。
Network traffic classification is important to intrusion detection and network management. Most of existing methods are based on machine learning techniques and rely on the features extracted manually from flows or packets. However, with the rapid growth of network applications, it is difficult for these approaches to handle new complex applications. In this article, we design a novel neural network, the Extended Byte Segment Neural Network (EBSNN), to classify netwrk traffic. EBSNN first divides a packet into header segments and payload segments, which are then fed into encoders composed of the recurrent neural networks with the attention mechanism. Based on the outputs, another encoder learns the high-level representation of the whole packet. In particular, side-channel features are learned from header segments to improve the performance. Finally, the label of the packet is obtained by the softmax function. Furthermore, EBSNN can classify network flows by examining the first few packets. Thorough experiments on the real-world datasets show that EBSNN achieves better performance than the state-of-the-art methods in both the application identification task and the website identification task.