Encrypted traffic classification encoder based on lightweight graph representation.

Area of Science:

• Computer Science
• Network Security
• Machine Learning

Background:

• Increasing adoption of encrypted traffic necessitates advanced methods for network analysis.
• Traditional methods struggle with unclear features and low accuracy in classifying encrypted traffic.
• Existing models often lack efficiency and lightweight properties for real-world deployment.

Purpose of the Study:

• To develop a lightweight encrypted traffic classification encoder using graph representation.
• To enhance the accuracy of malicious traffic detection and normal application classification.
• To reduce the model's parameter count while maintaining high performance.

Main Methods:

• Constructing byte-level traffic graphs from packet byte sequences.
• Utilizing GraphSAGE with sampling averaging for graph encoding.
• Employing an improved Transformer-based model with relative position encoding for classification.

Main Results:

• Achieved high F1 scores of 0.9938 on ISCX-2012 and 0.9856 on ISCX-Tor.
• Reduced model parameters by 18.2% compared to the TFE-GNN model.
• Outperformed over 12 baseline models in encrypted traffic classification tasks.

Conclusions:

• The proposed lightweight graph representation enhances encrypted traffic classification accuracy.
• The method effectively identifies network traffic applications and abnormal behaviors.
• This approach offers a balance between model efficiency and classification performance.