Wang Guanyu, Gu Yijun
College of Information and Cyber Security, People's Public Security University of China, Beijing 100038, China.
Sensors (Basel). 2024 May 12;24(10):3078. doi: 10.3390/s24103078.
The widespread use of encrypted traffic poses challenges to network management and network security. Traditional machine learning-based methods for encrypted traffic classification no longer meet the demands of management and security. The application of deep learning technology in encrypted traffic classification significantly improves the accuracy of models. This study focuses primarily on encrypted traffic classification in the fields of network analysis and network security. To address the shortcomings of existing deep learning-based encrypted traffic classification methods in terms of computational memory consumption and interpretability, we introduce a Parameter-Efficient Fine-Tuning method for efficiently tuning the parameters of an encrypted traffic classification model. Experimentation is conducted on various classification scenarios, including Tor traffic service classification and malicious traffic classification, using multiple public datasets. Fair comparisons are made with state-of-the-art deep learning model architectures. The results indicate that the proposed method significantly reduces the scale of fine-tuning parameters and computational resource usage while achieving performance comparable to that of the existing best models. Furthermore, we interpret the learning mechanism of encrypted traffic representation in the pre-training model by analyzing the parameters and structure of the model. This comparison validates the hypothesis that the model exhibits hierarchical structure, clear organization, and distinct features.
加密流量的广泛使用给网络管理和网络安全带来了挑战。传统的基于机器学习的加密流量分类方法已无法满足管理和安全需求。深度学习技术在加密流量分类中的应用显著提高了模型的准确性。本研究主要聚焦于网络分析和网络安全领域的加密流量分类。为解决现有基于深度学习的加密流量分类方法在计算内存消耗和可解释性方面的不足，我们引入了一种参数高效微调方法，用于有效调整加密流量分类模型的参数。使用多个公共数据集在各种分类场景下进行实验，包括Tor流量服务分类和恶意流量分类。与最先进的深度学习模型架构进行公平比较。结果表明，所提出的方法在实现与现有最佳模型相当性能的同时，显著降低了微调参数的规模和计算资源使用。此外，我们通过分析模型的参数和结构来解释预训练模型中加密流量表示的学习机制。这种比较验证了模型具有层次结构、清晰组织和独特特征的假设。
