CLSTM-MT (a Combination of 2-Conv CNN and BiLSTM Under the Mean Teacher Collaborative Learning Framework): Encryption Traffic Classification Based on CLSTM (a Combination of 2-Conv CNN and BiLSTM) and Mean Teacher Collaborative Learning
Source abstract
Abstract
The identification and classification of network traffic are crucial for maintaining network security, optimizing network management, and ensuring reliable service quality. These functions help prevent malicious activities, such as network attacks and illegal intrusions, while supporting the efficient allocation of network resources and enhancing user experience. However, the widespread use of traffic encryption technology, while improving data transmission security, also obscures the content of traffic, making it challenging to accurately classify and identify encrypted traffic. This limitation hampers both network security maintenance and further improvements in service quality. Therefore, there is an urgent need to develop an efficient and accurate encryption traffic identification method. This study addresses three key challenges: First, existing methods fail to explore the potential relationship between flow load features and sequence features during feature extraction. Second, there is a need for approaches that can adapt to the diverse characteristics of different protocols, ensuring the accuracy and robustness of encrypted traffic identification. Third, traditional deep learning models need large amounts of labeled data, which are expensive to acquire. To overcome these challenges, we propose an encrypted traffic recognition method based on a CLSTM model (a combination of 2-conv CNN and BiLSTM) and Mean Teacher collaborative learning. This approach detects and integrates traffic load features with sequence features to improve the accuracy and robustness of encrypted traffic identification while reducing the model’s reliance on labeled data through the consistency constraint of unlabeled data using Mean Teacher. Experimental results demonstrate that the CLSTM-MT collaborative learning method outperforms traditional methods in encrypted traffic identification and classification, achieving superior performance even with limited labeled data, thus addressing the high cost of data labeling.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Internet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China
Funding
National Key R&D Program of China
References (28)
Show source-provided references
1. Research Status and Development Trends on Network Encrypted Traffic Identification
2. Deep learning for encrypted traffic classification: An overview10.1109/MCOM.2019.1800819 ↗
3. Madhukar, A., and Williamson, C. (2006, January 11–14). A longitudinal study of P2P traffic classification. Proceedings of the 14th IEEE International Symposium on Modeling, Analysis, and Simulation, Monterey, CA, USA.
4. Yeganeh, S.H., Eftekhar, M., Ganjali, Y., Keralapura, R., and Nucci, A. (August, January 30). Cute: Traffic classification using terms. Proceedings of the 2012 21st International Conference on Computer Communications and Networks (ICCCN), Munich, Germany.10.1109/ICCCN.2012.6289207 ↗
5. Taylor, V.F., Spolaor, R., Conti, M., and Martinovic, I. (2016, January 21–24). AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), Saarbruecken, Germany.10.1109/EuroSP.2016.40 ↗
6. Huang, S., Chen, K., Liu, C., Liang, A., and Guan, H. (2009, January 12–14). A statistical-feature-based approach to internet traffic classification using Machine Learning. Proceedings of the 2009 International Conference on Ultra Modern Telecommunications & Workshops, St. Petersburg, Russia.
7. Perdisci, R., Lee, W., and Jajodia, S. (2014, January 24–27). A deep-learning approach to detecting encrypted malicious web traffic. Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, New York, NY, USA.
8. A deep convolutional neural network approach for encrypted traffic classification
9. Deep Learning for Network Traffic Monitoring and Analysis(NTMA): A Survey10.1016/j.comcom.2021.01.021 ↗
10. Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018, January 18–21). Kitsune: An ensemble of autoencoders for online network intrusion detection. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.10.14722/ndss.2018.23204 ↗
11. Hao, S., Hu, J., Liu, S., Song, T., Guo, J., and Liu, S. (2015, January 29–31). Improved SVM method for internet traffic classification based on feature weight learning. Proceedings of the 2015 International Conference on Control, Automation and Information Sciences (ICCAIS), Changshu, China.
12. Wang, M., Zheng, K., Luo, D., Yang, Y., and Wang, X. (2020, January 11–14). An Encrypted Traffic Classification Framework Based on Convolutional Neural Networks and Stacked Autoencoders. Proceedings of the 2020 IEEE 6th International Conference on Computer and Communications (ICCC), Chengdu, China.10.1109/ICCC51575.2020.9344978 ↗
13. Yang, Y., Kang, C., Gou, G., Li, Z., and Xiong, G. (2018, January 28–30). TLS/SSL Encrypted Traffic Classification with Autoencoder and Convolutional Neural Network. Proceedings of the 2018 IEEE 20th International Conference on High Performance Computing and Communications, Exeter, UK.10.1109/HPCC/SmartCity/DSS.2018.00079 ↗
14. Hang, Z., Lu, Y., Wang, Y., and Xie, Y. (2023, January 16–18). Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification. Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses (RAID ’23), Hong Kong, China.10.1145/3607199.3607206 ↗
15. He, K., Chen, X., Xie, S., Li, Y., Dollár, P., and Girshick, R. (2022, January 18–24). Masked Autoencoders Are Scalable Vision Learners. Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Orleans, LA, USA.10.1109/CVPR52688.2022.01553 ↗
16. Liu, C., He, L., Xiong, G., Cao, Z., and Li, Z. (May, January 29). FS-Net: A flow sequence network for encrypted traffic classification. Proceedings of the IEEE International Conference on Computer Communications (INFOCOM), Paris, France.
17. Identification of Encrypted Traffic Through Attention Mechanism Based Long Short Term Memory10.1109/TBDATA.2019.2940675 ↗
18. Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., and Yu, J. (2022, January 25–29). ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. Proceedings of the WWW‘22: The ACM Web Conference 2022, Lyon, France.10.1145/3485447.3512217 ↗
19. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017, January 4–9). Attention is all you need. Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS’17), Long Beach, CA, USA.
20. SemTra: A semi-supervised approach to traffic flow labeling with minimal human effort10.1016/j.patcog.2019.02.001 ↗
21. Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation
22. Zhou, G., Guo, X., Liu, Z., Li, T., Li, Q., and Xu, K. (2025, January 12–14). TrafficFormer: An Efficient Pre-trained Model for Traffic Data. Proceedings of the 2025 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.
23. Tarvainen, A., and Valpola, H. (2017, January 4–9). Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results. Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS’17), Long Beach, CA, USA.
24. Shi, K., Zeng, Y., Ma, B., Liu, Z., and Ma, J. (2003, January 4–8). MT-CNN: A Classification Method of Encrypted Traffic Based on Semi-Supervised Learning. Proceedings of the GLOBECOM 2023—2023 IEEE Global Communications Conference, Kuala Lumpur, Malaysia.10.1109/GLOBECOM54140.2023.10437895 ↗
25. Alam, S., Alam, Y., Cui, S., and Akujuobi, C.M. (2023, January 8–11). Unsupervised network intrusion detection using convolutional neural networks. Proceedings of the 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA.10.1109/CCWC57344.2023.10099151 ↗
26. Draper-Gil, G., Lashkari, A.H., Mamun, M.S.I., and Ghorbani, A.A. (2016, January 19–21). Characterization of encrypted and VPN traffic using time-related features. Proceedings of the 2nd International Conference on Information Systems Security and Privacy, Rome, Italy.10.5220/0005740704070414 ↗
27. Lashkari, A.H., Gil, G.D., Mamun, M.S.I., and Ghorbani, A.A. (2017, January 19–21). Characterization of Tor Traffic using Time based Features. Proceedings of the International Conference on Information Systems Security and Privacy, Porto, Portugal.
28. van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D.J., Lindorfer, M., Choffnes, D., van Steen, M., and Peter, A. (2020, January 23–26). FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2020.24412 ↗