Attribute-Based Zero-Shot Learning for Encrypted Traffic Classification

As more and more network applications have adopted encryption for user privacy, it poses a great challenge to identify increasing types of encrypted traffic. Recent methods mainly focus on leveraging machine learning or deep learning to improve the effectiveness of classification, and achieve good results in their experiments. However, most methods are developed for a limited number of traffic types on a close-world dataset, lacking the ability to transfer knowledge learned from available labeled data of known classes to the identification of unknown classes, of which the data is unseen during training. In this paper, we propose a novel attribute-based zero-shot learning (ZSL) framework for encrypted traffic classification, with both fine granularity for general classification and good scalability for identifying unknown classes. The framework is based on our defined attribute semantic space, consisting of two components: i) a feature-attribute embedding model to learn the mapping between flow features and attributes from seen classes. We use Temporal Convolution Network (TCN) for flow feature embedding and Simple Recurrent Units (SRU) for attribute embedding, with attention mechanisms introduced in both models for interpretability. ii) a GAN-based feature generation model FAE-G that leverages the trained FAE model to improve the generalization of the classifier for unseen classes. For generalized ZSL (GZSL) tasks, we introduce gradient-based rejection to classify both seen and unseen classes in a two-step way. The experimental results demonstrate that our method shows excellent performance in fine-grained classification, and also achieves presentable results in the identification of unknown classes.