Deep learning-based malicious traffic detection requires large-scale, accurately labeled datasets. However, realistic malicious traffic datasets contain noisy labels due to annotation errors, which can degrade the performance of detection models. Existing methods for handling noisy labels involve robust training or data cleaning. However, both approaches risk excluding hard samples from model update, leading to suboptimal decision boundaries and reduced classification performance. To this end, we introduce TRACE, a novel framework that leverages multi-loss optimization to induce robust traffic representations while utilizing all samples. TRACE utilizes a one-dimensional convolutional neural network (1D CNN) with multi-head attention to generate fine-grained traffic representations. Then, TRACE employs multi-loss optimization to enhance representation robustness, ensuring representation integrity and class separability, thereby laying the foundation for effective decision boundaries. The experimental results on two public datasets demonstrate that TRACE achieves an accuracy of 88.3% and an F1-score of 81% with 90% label noise, outperforming the state-of-the-art methods.

As many mobile apps generate substantial background traffic without active user interaction, network operators face increasing challenges in traffic management and analysis. However, existing approaches lack systematic methods for analyzing and identifying app background traffic. This paper presents BACKTRACKER, a novel background traffic identification system for mobile apps. To establish a reliable background traffic dataset, we design a semi-automated traffic collection framework integrating Android device with network traffic interception. We propose a URL similarity algorithm based on Levenshtein distance for accurate foreground-background traffic differentiation. Furthermore, we develop a hierarchical recognition model that combines statistical stability with deep learning expressiveness, integrating data augmentation, multi-head attention and BiLSTM networks for robust feature learning. Our extensive evaluation shows that BACKTRACKER significantly outperforms baseline methods, achieving 98.36% F1-score in background traffic identification. The results demonstrate BACKTRACKER’s effectiveness in background traffic analysis under encrypted network environments.

Traffic signs recognition (TSR) plays an essential role in assistant driving and intelligent transportation system. However, the noise of complex environment may lead to motion-blur or occlusion problems, which raise the tough challenge to real-time recognition with high accuracy and robust. In this article, we propose IECES-network which with improved encoders and Siamese net. The three-stage approach of our method includes Efficient-CNN based encoders, Siamese backbone and the fully-connected layers. We firstly use convolutional encoders to extract and encode the traffic sign features of augmented training samples and standard images. Then, we design the Siamese neural network with Efficient-CNN based encoder and contrastive loss function, which can be trained to improve the robustness of TSR problem when facing the samples of motion-blur and occlusion by computing the distance between inputs and templates. Additionally, the template branch of the proposed network can be stopped when executing the recognition tasks after training to raise the process speed of our real-time model, and alleviate the computational resource and parameter scale. Finally, we recombined the feature code and a fully-connected layer with SoftMax function to classify the codes of samples and recognize the category of traffic signs. The results of experiments on the Tsinghua-Tencent 100K dataset and the German Traffic Sign Recognition Benchmark dataset demonstrate the performance of the proposed IECES-network. Compared with other state-of-the-art methods, in the case of motion-blur and occluded environment, the proposed method achieves competitive performance precision-recall and accuracy metric average is 88.1%, 86.43% and 86.1% with a 2.9M lightweight scale, respectively. Moreover, processing time of our model is 0.1s per frame, of which the speed is increased by 1.5 times compared with existing methods.

Encrypted traffic classification using deep learning models based on packet length sequences has shown promising results. However, in real-world network conditions, network-induced phenomena such as packet loss, packet retransmission, and packet disorder are prevalent, leading to a decline in performance. To address this challenge, we propose Fractal, a novel approach designed to enhance existing deep learning models by integrating data augmentation and contrastive learning, thereby facilitating robust encrypted traffic classification under various network conditions. Specifically, Fractal employs three data augmentations to simulate different network conditions, generating diverse packet length sequences from the same flow. Contrastive learning is then leveraged to distill robust features from these augmented sequences. Fractal enables deep learning model to discern the intrinsic patterns of each flow, regardless of the variance in packet length sequences caused by network-induced phenomena. Our comprehensive evaluations demonstrate that Fractal enhances the classification performance of deep learning models under different network conditions, achieving 23% increase in accuracy and 15% improvement in F1-score.

In recent years, Distributed Reflective Denial of Service (DRDoS) attacks have emerged as a major threat to network security, utilizing IP spoofing and amplification mechanisms to drain network bandwidth. Existing approaches for DRDoS detection lack sophistication in feature selection and focus primarily on detection rather than fine-grained classification and targeted mitigation. In this paper, we propose DRDoSHunter, a novel approach that addresses these limitations. DRDoSHunter employs Frequency Domain Analysis (FDA) and inter-flow features to extract effective and robust features from continuous time series data. By utilizing a deep residual network model, our approach achieves accurate and efficient classification of DRDoS attacks at a fine-grained level. Experimental results on the CIC-DDoS2019 public dataset demonstrate that DRDoSHunter outperforms popular detection models, achieving an Fl-Score of over 98.44% for DRDoS attack detection and classification.