Internet traffic classification has been intensively studied over the past decade due to its importance for traffic engineering and cyber security. However, identifying the type of a network flow or a specific application become harder in recent years due to the use of encryption, e.g., by VPN and Tor.
In this talk, we will present a novel approach for classifying encrypted internet traffic using a combination of histograms of packet sizes and deep learning techniques. Our approach, called FlowPic, transforms histograms into a visual representation that is fed into a Convolution Neural Network (CNN) model for classification. Using the UNB ISCX datasets, we demonstrate that our approach can classify traffic with high accuracy, including VPN and Tor traffic. Additionally, we show that by using augmentations techniques that mimic network behavior, we can improve accuracy further, and propose a self-supervised contrastive representation learning method to cluster traffic of the same type without labels.
Our approach, FlowPic, achieves better performance than previous work and can handle classification problems that were not studied before. Furthermore, we demonstrate that using smaller mini-FlowPics can improve model performance and make the engineering easier.
Tal Shapira, Ph.D., conducting research in the fields of deep learning, computer networks, and cybersecurity. Currently a Post-Doc at the School of Computer Science, Reichman University, advised by Prof. Anat Bremler-Barr. Graduated magna cum laude with a P.hD. from Tel-Aviv University, where he was advised by Prof. Yuval Shavitt.
Tal is the Co-Founder & CTO at Reco, which develops a collaboration security platform, and a former head of a cybersecurity group within the Israeli Prime Minister’s Office.