Encrypted Traffic Classification Based on Hybrid Selective State Model

Traffic categorization is one of the fundamental tasks in computer networks. This task aims at associating network traffic with specific classes based on requirements (e.g., QoS provisioning). Traffic classification methods based on machine learning or deep learning are a hot topic of research. The prerequisite for model classification is feature extraction, and the features used for machine learning are generally flow-level features, e.g., statistical features, which require capturing the whole or most of the flow first, ignoring finer-grained features and under-characterizing the semantics of encrypted traffic. In contrast, the input features for deep learning can use stream-level features, packet-level features, and hybrid features that are a mixture of the two, where the hybrid features are features obtained by feature extraction from flows at different granularities, and thus the classification accuracy will be higher. However, most of these features extracted by deep learning features also need to capture the information of the whole flow, which can ensure high accuracy but cannot meet the practical application scenario, i.e., extracting part of the flow information to complete the classification task. Under the premise of guaranteeing high classification accuracy, in order to satisfy as much as possible that only part of the stream information is extracted to complete the stream classification task, this paper proposes a hybrid selective state model that combines the selective state space model and CNN (SSMC). The model takes the raw bytes of the first N packets of the stream extracted from the IP layer and the length sequence of the first N packets of the stream as the hybrid feature input, which ensures that the features of the stream are extracted from multi-granularity under the condition of extracting only some of the packets in the stream. Model To have better inference speed and inference ability, we combine the selective state space model with CNN. The experimental results show that the classification accuracy on two datasets, protocol classification and application classification, reaches 96.76% and 93.03% respectively, which is able to achieve a high level of accuracy based on the extraction of partial stream information.