论文标题
深度学习加密流量分类和未知数据检测
Deep Learning for Encrypted Traffic Classification and Unknown Data Detection
论文作者
论文摘要
尽管广泛使用加密技术来提供有关Internet通信的机密性,但移动设备用户仍然容易受到隐私和安全风险的影响。在本文中,提出了一个新的基于深层神经网络(DNN)的用户活动检测框架,以识别从移动应用程序(称为应用程序内活动)中从嗅觉的加密互联网流量流中执行的精细粒度用户活动。挑战之一是有无数的应用程序,几乎不可能使用所有可能的数据收集和培训DNN模型。因此,在这项工作中,我们利用DNN输出层的概率分布来过滤来自模型培训期间未考虑的应用程序(即未知数据)。所提出的框架使用基于时间窗口的方法将活动的交通流量划分为细分市场,因此只能通过仅观察与活动相关的流量的一小部分来确定应用程序内活动。我们的测试表明,基于DNN的框架在识别先前训练的应用程序内活动时表现出90%或更高的准确性,而在使用此框架时,在识别以前未经培训的应用程序内活动流量为未知数据方面的平均准确性为79%。
Despite the widespread use of encryption techniques to provide confidentiality over Internet communications, mobile device users are still susceptible to privacy and security risks. In this paper, a new Deep Neural Network (DNN) based user activity detection framework is proposed to identify fine grained user activities performed on mobile applications (known as in-app activities) from a sniffed encrypted Internet traffic stream. One of the challenges is that there are countless applications, and it is practically impossible to collect and train a DNN model using all possible data from them. Therefore, in this work we exploit the probability distribution of DNN output layer to filter the data from applications that are not considered during the model training (i.e., unknown data). The proposed framework uses a time window based approach to divide the traffic flow of an activity into segments, so that in-app activities can be identified just by observing only a fraction of the activity related traffic. Our tests have shown that the DNN based framework has demonstrated an accuracy of 90% or above in identifying previously trained in-app activities and an average accuracy of 79% in identifying previously untrained in-app activity traffic as unknown data when this framework is employed.