With more attention paid to user privacy and communication security, the volume of encrypted traffic rises sharply, which brings a huge challenge to traditional rule-based traffic classification methods. Combining machine learning algorithms and manual-design features has become the mainstream methods to solve this problem. However, these features depend on professional experience heavily, which needs lots of human effort. And these methods divide the encrypted traffic classification problem into piece-wise sub-problems, which could not guarantee the optimal solution. In this paper, we apply the recurrent neural network to the encrypted traffic classification problem and propose the Flow Sequence Network (FS-Net). The FS-Net is an end-to-end classification model that learns representative features from the raw flows, and then classifies them in a unified framework. Moreover, we adopt a multi-layer encoder-decoder structure which can mine the potential sequential characteristics of flows deeply, and import the reconstruction mechanism which can enhance the effectiveness of features. Our comprehensive experiments on the real-world dataset covering 18 applications indicate that FS-Net achieves an excellent performance (99.14% TPR, 0.05% FPR and 0.9906 FTF) and outperforms the state-of-the-art methods. Index Terms–Encrypted Traffic Classification, Recurrent Neural Network, Reconstruction Mechanism

FS-Net: A Flow Sequence Network For Encrypted Traffic Classification

Computer networks have fallen easy prey to cyber attacks in the ever-evolving internet services. Domain Name System (DNS) has also not remained untouched with these cybercrime attempts. Encrypted HyperText Transfer Protocol (HTTP) traffic over Secure Socket Layer (SSL), alternatively called HTTPS, has succeeded to prevent DNS attacks to a great extent. To secure DNS traffic, the security community has introduced the concept of DNS over HTTPS (DoH) to improve user privacy and security by combating eavesdropping and DNS data manipulation on the way to prevent Man-in-the-Middle (MitM) attacks. This paper discusses one of the persistent security concerns, abuse of DNS protocol to create covert channels by tunneling data through DNS packets. We identify tunneling activities that utilize DNS communications over HTTPS by presenting a two-layered approach to detect and characterize DoH traffic using time-series classifiers.

Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic

Toward effective mobile encrypted traffic classification through deep learning

DISTILLER: Encrypted traffic classification via multimodal multitask deep learning

Many network services and tools (e.g. network monitors, malware-detection systems, routing and billing policy enforcement modules in ISPs) depend on identifying the type of traffic that passes through the network. With the widespread use of mobile devices, the vast diversity of mobile apps, and the massive adoption of encryption protocols (such as TLS), large-scale encrypted traffic classification becomes increasingly difficult. In this paper, we propose a deep learning model for mobile app identification that works even with encrypted traffic. The proposed model only needs the payload of the first few packets for classification, and, hence, it is suitable even for applications that rely on early prediction, such as routing and QoS provisioning. The deep model achieves between 84% to 98% accuracy for the identification of 80 popular apps. We also perform occlusion analysis to bring insight into what data is leaked from SSL/TLS protocol that allows accurate app identification. Moreover, our traffic analysis shows that many apps generate not only app-specific traffic, but also numerous ambiguous flows. Ambiguous flows are flows generated by common functionality modules, such as advertisement and traffic analytics. Because such flows are common among many different apps, identifying the source app that generates ambiguous flows is challenging. To address this challenge, we propose a CNN+LSTM model that uses adjacent flows to learn the order and pattern of multiple flows, to better identify the app that generates them. We show that such flow association considerably improves the accuracy, particularly for ambiguous flows. Furthermore, we show that our approach is robust to mixed traffic scenarios where some unrelated flows may appear in adjacent flows. To the best of our knowledge, this is the first work that identifies the source app for ambiguous flows.

Large-Scale Mobile App Identification Using Deep Learning

With the explosion of network applications, network anomaly detection and security management face a big challenge, of which the first and a fundamental step is traffic classification. However, for the sake of user privacy, encrypted communication protocols, e.g. the SSL/TLS protocol, are extensively used, which results in the ineffectiveness of traditional rule-based classification methods. Existing methods cannot have a satisfactory accuracy of encrypted traffic classification because of insufficient distinguishable characteristics. In this paper, we propose the Multi-attribute Markov Probability Fingerprints (MaMPF), for encrypted traffic classification. The key idea behind MaMPF is to consider multi-attributes, which includes a critical feature, namely “length block sequence” that captures the time-series packet lengths effectively using power-law distributions and relative occurrence probabilities of all considered applications. Based on the message type and length block sequences, Markov models are trained and the probabilities of all the applications are concatenated as the fingerprints for classification. MaMPF achieves 96.4% TPR and 0.2% FPR performance on a real-world dataset from campus network (including 950,000+ encrypted traffic flows and covering 18 applications), and outperforms the state-of-the-art methods.

MaMPF: Encrypted Traffic Classification Based on Multi-Attribute Markov Probability Fingerprints

Content Delivery Networks (CDNs) are critical for providing good user experience of cloud services. CDN providers typically collect various multivariate Key Performance Indicators (KPIs) time series to monitor and diagnose system performance. State-of-the-art anomaly detection methods mostly use deep learning to extract the normal patterns of data, due to its superior performance. However, KPI data usually exhibit non-additive Gaussian noise, which makes it difficult for deep learning models to learn the normal patterns, resulting in degraded performance in anomaly detection. In this paper, we propose a robust and noise-resilient anomaly detection mechanism using multivariate KPIs. Our key insight is that different KPIs are constrained by certain time-invariant characteristics of the underlying system, and that explicitly modelling such invariance may help resist noise in the data. We thus propose a novel anomaly detection method called SDFVAE, short for Static and Dynamic Factorized VAE, that learns the representations of KPIs by explicitly factorizing the latent variables into dynamic and static parts. Extensive experiments using real-world data show that SDFVAE achieves a F1-score ranging from 0.92 to 0.99 on both regular and noisy dataset, outperforming state-of-the-art methods by a large margin.

SDFVAE: Static and Dynamic Factorized VAE for Anomaly Detection of Multivariate CDN KPIs

DNS tunnel is a technology used to bypass firewalls for data exfiltration. It takes advantage of the characteristic of firewalls that always allow DNS traffic pass. Most of the studies have realized the detection of DNS tunnels from the perspective of traffic and payload. In recent years, due to the popularity of machine learning and data mining methods, researchers began trying to use them to detect DNS tunnels. However, these detection methods require a lot of professional knowledge to extract and construct feature set, and the detection results are often unsatisfactory. In order to solve the problem of manual feature extraction limitation and improve the detection accuracy of DNS tunnels, we propose a deep learning method, called Byte-level CNN, to detect the DNS tunnels in this paper. Furthermore, we propose to represent DNS packets with bytes for the first time, as the converted computable data to the CNN model. Compared with traditional machine learning methods, our byte-level CNN method can learn full information in the whole DNS packets, especially the sequential and structural information, besides common statistical information, and therefore achieves good performance results. The simulation showed that the detection accuracy and recall rate are significantly improved, and the complex manual feature extraction process is avoided as well.

A Byte-level CNN Method to Detect DNS Tunnels

With the continuous improvement of the traffic analysis techniques, traditional network covert channels based on the TCP/IP architecture are facing many risks. Blockchain is a new kind of decentralized public network. The openness together with strong tamper resistance of the blockchain makes it become a natural platform to construct covert channel. However, the existing blockchain-based covert channels have a major drawback: the recipient identifies the transactions containing covert messages through the fixed labels, which significantly reduces the availability and concealment of the system. In this paper, we propose a new blockchain covert channel construction scheme, DLchain, which substitutes the fixed labels with dynamic labels. We design a dynamic label generation algorithm based on the statistical distribution of the real transaction data to ensure the concealment of the dynamic labels. We prove that DLchain has the features of undetectability, anti-traceability and strong robustness.

Chang Liu

Papers

FS-Net: A Flow Sequence Network For Encrypted Traffic Classification

MaMPF: Encrypted Traffic Classification Based on Multi-Attribute Markov Probability Fingerprints

SDFVAE: Static and Dynamic Factorized VAE for Anomaly Detection of Multivariate CDN KPIs

A Byte-level CNN Method to Detect DNS Tunnels

DLchain: A Covert Channel over Blockchain Based on Dynamic Labels