SpBiSeq: An Early-Stage Fingerprint Generation Method with High Robustness for Encrypted Mobile Application Traffic

Early-stage encrypted traffic classification refers to the identification of the application to which the flow belongs within a limited number of transmission packets or bytes after the network flow is connected and before the end of the data transfer cycle. Accurate identification is an important foundation for quality of service (QoS), network management, policy-based routing, and traffic accounting. With the widespread use of common encryption protocols such as Transport Layer Security Protocol (TLS) and Quick UDP Internet Connection (QUIC), traffic is showing a trend of being fully encrypted, in addition, the large-scale traffic in the mobile core network, traffic asymmetry, packet loss and disorder caused by complex network topology present enormous challenges to the early-stage classification of mobile application traffic. In this paper, we propose a highly robust early-stage classification fingerprint generation method for encrypted mobile traffic named SpBiSeq (Simple Bi-Directional Sequence), which has better classification performance, better anti packet loss ability than previous studies. Furthermore, SpBiSeq has low time and space complexity, which makes it well adapted to high-speed network environments.