Bi-ETC: A Bidirectional Encrypted Traffic Classification Model Based on BERT and BiLSTM

While packet encryption technology provides user privacy protection, it also brings challenges to traffic classification. Traditional traffic classification technologies based on packet fields or payload data content are becoming powerless in the face of encrypted traffic. Although traffic encryption technology can hide data content, it cannot change the inherent characteristics of application traffic. Therefore, how to classify encrypted traffic by mining traffic features has become a topic of widespread concern. An enormous amount of research shows that machine learning algorithms achieve good results in encrypted traffic classification. However, there is still room for improvement. For example, deep learning methods require a large amount of labeled training data, and it is difficult for pre-trained models to capture the associated features of long sequences of packet. This paper propose a Bidirectional encrypted traffic classification model based on BERT and BiLSTM(Bi-ETC), by inserting [CLS]Token at the connection of Token sequence between BERT and BiLSTM, strengthens BiLSTM's focus on packet-level features while maintaining BilSTM's capture of Token sequence context. Experimental results show that the Bi-ETC model is superior to all proposed classification methods on the ISCX VPN dataset, reaching 99.43%in F1 score and 99.7%in accuracy.