SUBMITTED TO IEEE COMMUNICATIONS MAGAZINE 1
Deep Learning for Encrypted Traffic Classification:
An Overview
Shahbaz Rezaei, Member, IEEE, and Xin Liu, Senior, Member,
Abstract—Traffic classification has been studied for two
decades and applied to a wide range of applications from QoS
provisioning and billing in ISPs to security-related applications in
firewalls and intrusion detection systems. Port-based, data packet
inspection, and classical machine learning methods have been
used extensively in the past, but their accuracy have been declined
due to the dramatic changes in the Internet traffic, particularly
the increase in encrypted traffic. With the proliferation of
deep learning methods, researchers have recently investigated
these methods for traffic classification task and reported high
accuracy. In this article, we introduce a general framework for
deep-learning-based traffic classification. We present commonly
used deep learning methods and their application in traffic
classification tasks. Then, we discuss open problems and their
challenges, as well as opportunities for traffic classification.
Index Terms—Traffic classification, deep learning, machine
learning.
I. INTRODUCTION
T
RAFFIC classification, the categorization of network
traffic into appropriate classes, is important to many
applications, such as quality of service (QoS) control, pricing,
resource usage planning, malware detection, and intrusion de-
tection. Because of its importance, many different approaches
have been developed over years to accommodate the diverse
and changing needs of different application scenarios. In par-
ticular, new advances in communications, including encryption
and port obfuscation, raise additional challenges to network
classification.
Traffic classification techniques have evolved significantly
over time. The first and easiest approach is to use port
numbers. However, its accuracy has been decreasing because
newer applications either use well-known port numbers to
disguise their traffic or do not use standard registered port
numbers. Despite its inaccuracy, the port number is still widely
used either alone or in tandem with other features in practice.
The next generation of traffic classifiers, relying on payload
or data packet inspection (DPI), focuses on finding patterns or
keywords in data packets. These methods are only applicable
to unencrypted traffic and has high computational overhead. As
a result, a new generation of methods, based on flow-statistics,
emerged. These methods rely on statistical or time series
features, which enable them to handle both encrypted and
unencrypted traffic. These methods usually employ classical
machine learning (ML) algorithms, such as random forest (RF)
and k-nearest neighbor (KNN). However, their performance
S. Rezaei and X. Liu are with Computer Science Department, Uni-
versity of California, Davis, USA (e-mails: srezaei@ucdavis.edu and
liu@cs.ucdavis.edu).
Manuscript received April 19, 2005; revised August 26, 2015.
heavily depends on the human-engineered features, which
limit their generalizability.
Deep learning obviates the need to select features by a do-
main expert because it automatically selects features through
training. This characteristic makes deep learning a highly de-
sirable approach for traffic classification, especially when new
classes constantly emerge and patterns of old classes evolve.
Another important characteristic of deep learning is that it has
a considerably higher capacity of learning in comparison to
traditional ML methods, and thus can learn highly complicated
patterns. Combining these two characteristics, as an end-to-end
approach, deep learning is capable of learning the non-linear
relationship between the raw input and corresponding output
without the need to break the problem into the small sub-
problems of feature selection and classification.
Recent work has demonstrated the efficacy of deep learning
methods in traffic classification, in particular, in encrypted
traffic. To achieve this goal, DL requires sufficient labeled
data and adequate computation power. In this article, we
will overview the general framework for (encrypted) traffic
classification task. We provide general guidelines for classifi-
cation tasks, including data collection and cleaning, feature
selection, and model selection. Moreover, we discuss deep
learning techniques and how they have been applied for traffic
classification task. Finally, open problems and future directions
are discussed.
II. OVERVIEW OF CLASSIFICATION PROBLEMS ON
COMPUTER NETWORK
Fig. 1 illustrates a general framework for traffic classifica-
tion, comprising seven steps. Most existing work adopts all or
part of the framework. We discuss the first four steps in this
section, and the last three in the next section, with a focus on
deep-learning-based approaches.
A. Problem Definition
The first step to build a network traffic classifier is to
clearly define the goal of classification. Typical goals include
QoS provisioning, resource usage planning, billing system
customization, intrusion detection, and malware detection. To
serve its goal, one can categorize traffic classes based on 1)
protocols (e.g. UDP, TCP, FTP or HTTP), 2) applications (e.g.
Skype, WeChat or Torrent), 3) traffic-types (e.g. browsing,
downloading or video chat), 4) websites, 5) user actions (e.g.
posting a comment or sending voice message), 6) operating
systems, 7) browsers, and so on. Hence, the goal is to label
each flow with corresponding traffic classes. A flow is usually
arXiv:1810.07906v2 [cs.NI] 26 Jan 2019