The classification of encrypted traffic plays a crucial role in network management and security. As encrypted network traffic becomes increasingly complicated and challenging to analyze, there is a growing need for more efficient and comprehensive analytical approaches. Our proposed method introduces a novel approach to network traffic classification, utilizing multi-task learning to simultaneously train multiple tasks within a single model. To validate the proposed method, we conducted experiments using the ISCX 2016 VPN/Non-VPN dataset, consisting of three tasks. The proposed method outperformed the majority of existing methods in classification with 99.29%, 97.38%, and 96.89% accuracy in three tasks (i.e., encapsulation, category, and application classification, respectively). The efficiency of the proposed method also demonstrated outstanding performance when compared to methods excluding lightweight models. The proposed approach demonstrates accurate and efficient multi-task classification on encrypted traffic.

While user-oriented service industries are rapidly growing, various network devices provide these services through different access paths. Accordingly, the network flow is also increasing explosively. As demand for management related to limited network resources increases, the network traffic classification grows to prominence. Usually, a quick classification task was possible with hundreds of data composed of dozens of features. Afterward, deep learning models have proliferated owing to an outstanding performance that overwhelms existing performance based on hundreds of thousands of features and data. However, the deep learning models showing one of the best performances cannot be free from two facts. One is a lot of time and resource consumption. The other is an uncertain explanation of the process. We solved these problems. Firstly, we used two methods to overcome resource constraints. We modified the DistilBERT applied with knowledge distillation for using a compressed model and securing a remarkable performance. We used a lightweight packet with a header and partial payload for feature reduction. Consequently, our XENTC can process four multi-attribute packets simultaneously and effectively by removing the superfluity of features. And it achieved 97.0~98.1% F1 scores. The required time to classify a packet using a trained model is 0.0093 seconds. Therefore, it can be one of the feasible solutions. Secondly, to approach human-understandable XAI, we analyzed the relationships between the features by associating them with the packet structure. At the specific point of the model’s finished training, it was revealed what the important features of the packet were by counting the Top-5 number of times among the attention values. In addition, we visualized the classification performance of the model using t-SNE to enable intuitive understanding.

The necessity of Network traffic classification is becoming increasingly significant as users’ applications and devices become more diverse and prevalent. As encryption becomes the norm for security reasons, the traffic classification problem is not easily solved. In this work, we provide an inductive counterevidence to the vague belief that deep learning models can perform well and outperform tree-based machine learning models in all aspects across domains, especially in the network traffic classification domain. We address the problem of finding an efficient encrypted traffic classification method in resource-constrained situations in the network traffic classification domain by limiting the scope of our research. Using the first packet, we converted packet headers and encrypted partial payloads into tabular data through a standardized format. We used them as the same inputs for lightweight deep learning and tree-based machine learning models, analyzed their performance, and identified efficient models. Next, we improved the performance of the previously selected efficient traffic classifier through data augmentation methods. Augmentation was performed to a degree that did not significantly damage the original data distribution so that the augmented dataset’s class distribution did not interfere with model learning. We applied two fundamentally contrasting methods to augment traffic data, depending on whether the basis of data augmentation is individual data or the entire data. Data augmentation increased the accuracy of the machine learning model by 0.26%, which complemented the machine learning model’s performance in network traffic classification and made the machine learning model outperform the lightweight deep learning model.