An Encrypted Traffic Classification Approach Based on Path Signature Features and LSTM

Abstract

Classifying encrypted traffic is a crucial aspect of network security. However, popular methods face several limitations, such as a reliance on feature engineering and the need for complex model architectures to ensure effective classification. To address these challenges, we propose a method that combines path signature features with Long Short-Term Memory (LSTM) models to classify service types within encrypted traffic. Our approach constructs traffic paths using packet size and arrival times. We generate path signature features at various scales using an innovative multi-scale cumulative feature extraction technique. These features serve as inputs for LSTM networks to perform the classification. Notably, by using only 24 sequential packet features in conjunction with LSTM models, our method has achieved significant success in classifying service types within encrypted traffic. The experimental results highlight the superiority of our proposed method compared to leading approaches in the field.