The widespread use of encryption protocols and increasing privacy demands have significantly increased encrypted traffic, creating new challenges for network monitoring and threat detection. Current methods struggle with diverse scenarios and distinguish between subtle traffic patterns within webpages of the same application. To address these challenges, we introduce ANT-ET, an end-to-end multimodal framework designed for fine-grained encrypted webpage traffic fingerprinting. ANT-ET leverages a transformer to model payload semantics and constructs a traffic interaction graph to capture both temporal and spatial characteristics of packet interactions. Additionally, ANT-ET incorporates a gradient reversal layer to improve generalization by facilitating domain-invariant feature learning across related webpages. Experimental results demonstrate ANT-ET’s superior performance compared to various baseline models, which were evaluated using a proprietary encrypted webpage traffic dataset and three public datasets. Ablation studies confirm the effectiveness of different framework components, while sensitivity and complexity analyses further validate ANT-ET’s robustness and flexibility.
YuSZhouWJiaW, et al.Discriminating DDoS attacks from flash crowds using flow correlation coefficient. IEEE Trans Parallel Distrib Syst2011; 23: 1073–1080.
3.
RamadhaniE. Anonymity communication VPN and Tor: A comparative study. J Phys Conf Ser2018;983:012060.
4.
PapadogiannakiEIoannidisS. A survey on encrypted network traffic analysis applications, techniques, and countermeasures. ACM Comput Surv (CSUR)2021; 54: 1–35.
5.
LinXXiongGGouG, et al.ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. In: WWW' 22: The ACM Web Conference 2022, Virtual Event, Lyon, France, April 25–29, 2022, 2022, pp. 633–642. ACM.
6.
ZhangHYuLXiaoX, et al.TFE-GNN: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification. In: Proceedings of the ACM Web Conference 2023, WWW 2023, Austin, TX, USA, 30 April 2023–4 May 2023, 2023, pp. 2066–2075. ACM.
7.
PangBFuYRenS, et al.A multi-modal approach for context-aware network traffic classification. In: IEEE International Conference on Acoustics, Speech and Signal Processing ICASSP 2023, Rhodes Island, Greece, June 4–10, 2023, 2023, pp. 1–5. IEEE.
8.
PanchenkoALanzeFPennekampJ, et al. Website fingerprinting at internet scale. In: 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21–24, 2016, 2016, pp. 23477. The Internet Society.
9.
ShenMLiuYZhuL, et al.Fine-grained webpage fingerprinting using only packet length information of encrypted traffic. IEEE Transactions on Information Forensics and Security2020; 16: 2046–2059.
10.
AbbasiMShahrakiATaherkordiA. Deep learning for network traffic monitoring and analysis (NTMA): A survey. Comput Commun2021; 170: 19–41.
11.
KongHLiTGeJ, et al.A novel method with transformers for fine-grained encrypted traffic classification. In: IEEE International Conference on High Performance Computing & Communications, Data Science & Systems, Smart City & Dependability in Sensor, Cloud & Big Data Systems & Application, HPCC/DSS/SmartCity/DependSys 2023, Melbourne, Australia, December 17–21, 2023, 2023, pp. 74–81. IEEE.
12.
HeHYYangZGChenXN. PERT: Payload encoding representation from transformer for encrypted traffic classification. In: 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation, Kaleidoscope, Ha Noi, Vietnam, December 7–11, 2020, 2020, pp. 1–8. IEEE.
13.
DevlinJChangM-WLeeK, et al.Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018.
14.
ShenMZhangJZhuL, et al.Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans Inf ForenSec2021; 16: 2367–2380.
15.
VaswaniAShazeerNParmarN, et al.Attention is all you need. In: Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4–9, 2017, Long Beach, CA, USA, 2017,2017, pp. 5998–6008.
16.
GaninYLempitskyV. Unsupervised domain adaptation by backpropagation. In: Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France, 6–11 July 2015, Volume 37 of JMLR Workshop and Conference Proceedings, 2015, pp. 1180–1189. JMLR.org.
17.
Draper-GilGLashkariAHMamunMSI, et al.Characterization of encrypted and VPN traffic using time-related. In: Proceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP 2016, Rome, Italy, February 19–21, 2016, 2016, pp. 407–414. SciTePress.
18.
WangWZhuMZengX, et al.Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference on Information Networking, ICOIN 2017, Da Nang, Vietnam, January 11–13, 2017, 2017, pp. 712–717. IEEE.
19.
DingSXuYXuH, et al.A multimodal deep fusion network for mobile traffic classification. In: Wireless Algorithms, Systems, and Applications - 17th International Conference, WASA 2022, Dalian, China, November 24–26, 2022, Proceedings, Part II, Volume 13472 of Lecture Notes in Computer Science, 2022, pp. 384–392. Springer.
20.
LiRXiaoXNiS, et al.Byte segment neural network for network traffic classification. In: 26th IEEE/ACM International Symposium on Quality of Service, IWQoS 2018, Banff, AB, Canada, June 4–6, 2018, 2018, pp. 1–10. IEEE.
21.
TaylorFVincentRSContiM, et al.Robust smartphone app identification via encrypted network traffic analysis. IEEE Trans Inf Foren Sec2017; 13: 63–78.
22.
LotfollahiMSiavoshaniMJZadeRSH, et al.Deep packet: A novel approach for encrypted traffic classification using deep learning. Soft Comput2020; 24: 1999–2012.
23.
LiuCHeLXiongG, et al.FS-Net: A flow sequence network for encrypted traffic classification. In: 2019 IEEE Conference on Computer Communications, INFOCOM 2019, Paris, France, April 29–May 2, 2019, 2019, pp. 1171–1179. IEEE.
24.
LiuCWangWWangM, et al.An efficient instance selection algorithm to reconstruct training set for support vector machine. Knowl Based Syst2017; 116: 58–73.
25.
KingmaDPBaJ. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
26.
GitHub – dmlc/dgl: Python package built to ease deep learning on graph, on top of existing DL frameworks.–github.com, https://github.com/dmlc/dgl (accessed 1 November 2024).
27.
Al-NaamiKChandraSMustafaA, et al.Adaptive encrypted traffic fingerprinting with bi-directional dependence. In: Proceedings of the 32nd Annual Conference on Computer Security Applica- tions, ACSAC 2016, Los Angeles, CA, USA, December 5–9, 2016, 2016, pp. 177–188. ACM.
28.
Van EdeTBortolameottiRContinellaA, et al.Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic. In: 27th Annual Network and Distributed System Security Symposium, NDSS 2020, San Diego, California, USA, February 23–26, 2020, 2020. The Internet Society.
29.
PhamT-DHoT-LTruong-HuuT, et al.Mappgraph: Mobile-app classification on encrypted network traffic using deep graph convolution neural networks. In: ACSAC ’21: Annual Computer Security Applications Conference, Virtual Event, USA, December 6–10, 2021, 2021, pp. 1025–1038. ACM.
30.
DongCZhangCLuZ, et al.Cetanalytics: Comprehensive effective traffic information analytics for encrypted traffic classification. Comput Netw2020; 176: 107258.
31.
LinKXuXGaoH. TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT. Comput Netw2021; 190: 107974.
32.
AndersonBMcGrewD. Identifying encrypted malware traffic with contextual flow data. In: Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, AISec@CCS 2016, Vienna, Austria, October 28, 2016, 2016, pp. 35–46. ACM.
33.
AndersonBMcGrewD. Machine learning for encrypted malware traffic classification: Accounting for noisy labels and non-stationarity. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada, August 13–17, 2017, 2017, pp. 1723–1732. ACM.
34.
MühlhauserMPridöhlHHerrmannD. How private is android’s private DNS setting? Identifying apps by encrypted DNS traffic. In: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna, Austria, August 17–20, 2021, 2021, pp. 14:1–14:10. ACM.
35.
LiuCXiongGGouG, et al.Classifying encrypted traffic using adaptive fingerprints with multi-level attributes. World Wide Web2021; 24: 2071–2097.
36.
WangWZhuMWangJ, et al.End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In: 2017 IEEE International Conference on Intelligence and Security Informatics, ISI 2017, Beijing, China, July 22–24, 2017, 2017, pp. 43–48. IEEE.
37.
ZhengJLiD. GCN-TC: Combining trace graph with statistical features for network traffic classification. In: 2019 IEEE International Conference on Communications, ICC 2019, Shanghai, China, May 20–24, 2019, 2019, pp. 1–6. IEEE.
