Multi-Level Pre-Training for Encrypted Network Traffic Classification

Abstract

With the recent growth of network environments, the use of encrypted traffic has increased, making traditional methods less effective. Consequently, research on encrypted traffic analysis using Machine Learning (ML) and Deep Learning (DL) techniques has become more widespread, with pre-training methods gaining particular attention mechanism. Network traffic typically occurs in the form of packets composed of multiple bytes, and each packet consists of various fields with specific meanings. These field information plays a crucial role in identifying the type or purpose of the traffic, but most of the studies have focused solely on the byte and packet level. In this paper, we propose a Multi-Level Pre-training for Encrypted Traffic Classification (MLETC) model. This model applies two pre-training strategies that consider multi-level traffic representations, including byte, field, and packet. By employing these pre-training strategies, we achieve comprehensive training on traffic data, which enables the development of a robust pre-trained model. We conducted experiments using three public datasets to validate the performance of MLETC. The results show that MLETC outperforms existing ML and DL-based models in most downstream tasks and achieves high performance comparable to existing pre-trained models. Additionally, we demonstrate that a pre-trained model considering bytes, fields, and packets together outperforms a pre-trained model that only considers bytes and packets.