Abstract While encrypted traffic protects user privacy and data security, it is also frequently exploited by malicious actors for illegal activities, e.g., phishing and malware distribution. Therefore, accurately and efficiently identifying user behavior behind encrypted traffic is crucial to maintaining network security. However, existing encrypted traffic classification methods rely on flow-level feature extraction, which is ineffective for short traffic flow. Additionally, these methods only analyze the graph interaction structure between local clients and remote servers, failing to effectively utilize the byte-level information in packets. This results in limited adaptability and low accuracy. To address these limitations, in this paper, we propose an encrypted traffic classification method, named Global-Statistical features and Packet-Bytes, for feature extraction and fusion. This method effectively utilizes byte-level information and constructs a graph structure based on sliding windows and Jaccard similarity between packet bytes. In particular, we design a triple embedding layer to embed traffic flow features and packet byte features. Feature fusion is achieved through an encoder-decoder module and a cross-gated feature fusion mechanism. Experiments on public datasets show that our method outperforms several state-of-the-art methods in fine-grained encrypted traffic classification tasks.

Graph kernels are a significant class of tools for measuring the similarity of graph data, which is the basis of a wide range of graph learning methods. However, graph kernels often suffer from high computing overhead. With the shining of cloud computing, it is desirable to transfer the computing burden to the server with abundant computing resources to reduce the cost of local machines. Nonetheless, under the honest-but-curious cloud assumption, the server may peek at the data, raising privacy concerns. To eliminate the risk of data privacy leakage, we propose CloudRGK to securely perform Random walk Graph Kernel(RGK), one of the most well-known graph kernels, on the cloud. We first prove that the edge- and vertex-labeled graphs could be transformed into an equivalent matrix representation. Afterward, we prove that the cloud could perform the core operations in RGK on the encrypted graphs without feature information loss. Evaluations of the real-world graph data demonstrate that our strategy significantly reduces the overhead of the local party to perform RGK without performance degradation. Meanwhile, it introduces only a small amount of extra computation cost. To the best of our knowledge, it is the first work towards private graph kernel computation on the cloud.

Edge network devices are typically resource-constrained, but intrusion detection requires real-time capabilities. Currently deep learning detection models for raw traffic data require significant computational resources, which does not meet our requirements. In addition, purely manual feature extraction may lead to lower accuracy, even though it can make the algorithm more lightweight. Taking these considerations into account, this paper proposes a machine learning network—LLAMNet, which offers lower latency and memory requirements. The proposed model takes a more comprehensive approach to capturing the deep structure of network traffic. It leverages attention mechanisms to effectively uncover the temporal characteristics among the packets that form the network flow. This enables a more thorough exploration of the sequential features within the data. To minimize latency and memory overhead, sparse self-attention mechanisms and self-attention distillation techniques are utilized in our approach. Additionally, in order to better suit the intrusion detection task, we have implemented enhancements that enable the lightweight network architecture to achieve accurate detection rates. Furthermore, experiments were conducted on publicly available datasets, including a series of ablation experiments to assess the effectiveness of our improvements.

Encrypted communications, implemented for the confidential information exchange, facilitate the preservation of individual privacy. Unfortunately, some criminals abuse encrypted communications to conduct illegal activities, leading to the proliferation of the Darknet. To curb malicious darknet activities, the accurate and effective classification of darknet traffic is imperative. Considerable endeavors have been devoted to identifying the darknet traffic. However, the classification of darknet applications has not yielded a satisfactory result. This deficiency arises from the limitations of current approaches, e.g., some traditional methods rely on hand-crafted features that consume labor, and other neural network-based methods disregard the graph structure of the traffic. To tackle these challenges, we propose the Darknet Traffic Graph (DTG), a graph structure that captures the interactions between local clients and remote servers in darknet traffic. Furthermore, based on DTG, we combine the GNN model and attention mechanism to create the Darknet Graph Neural Networks, i.e., DGNN, a powerful model that sufficiently exploits the benign and darknet traffic features. As a result, on the CIC-Darknet2020 dataset, the accuracy of DGNN in traffic classification and application classification is 98.52% and 99.06%, respectively, which outperforms other classifiers.