Higher Layers, Better Results: Application Layer Feature Engineering in Encrypted Traffic Classification

Abstract

Encrypted traffic has become the primary carrier of network transmission, and encrypted traffic classification is essential for advanced network management and security protection. Existing studies mainly focus on encrypted traffic feature engineering and classification model design, aiming to select more expressive features from encrypted traffic and achieve high-performance classification. The most commonly used features in the feature engineering process are statistical features and sequence features obtained in network or transport layers, which are more inclined to represent the factors of network transmission rather than the data attributes of applications or services. As a result, the relevance of the features and application or services is not strong, leading to unsatisfactory performance. To solve this problem, we introduce the Application Data Unit (ADU) and put forward the application layer feature engineering, which uses the features of the highest protocol level - the application layer to achieve better HTTPS classification. In order to compare the classification effects of features of different layers, we carried out experiments on traditional machine learning models based on statistical features and deep learning models based on sequence features, respectively. The results show that the proposed ADU features are better than the segment granularity features of the TLS layer and far better than the packet granularity features both in statistical and length sequence features. The average F1-score increase in the encrypted traffic application classification scenario is more than 10%.