深度学习和流量分类：从包含数百个加密和零日应用程序的商业级数据集中吸取的经验教训
Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications
摘要：
机器学习（ML）和深度学习（DL）的日益成功最近重新引发了人们对流量分类的兴趣。虽然已知流量的分类是一个经过充分研究的主题，已知监督分类工具（如ML和DL模型）可以提供令人满意的性能，但未知（或零日）流量的检测更具挑战性，通常由无监督技术（如聚类算法）处理。在本文中，我们分享了我们在商业级DL流量分类引擎上的经验，该引擎能够（i）从加密流量中识别已知应用，以及（ii）处理未知的零日应用。特别是，我们对（i）的贡献是在商业级设置中对最先进的流量分类器进行全面评估，这些流量分类器包括数千个非常细粒度的应用程序标签，与学术评估中通常针对的几十个类别相反。此外，我们通过提出一种新的技术来解决（ii）零日应用程序的检测问题，该技术专为DL模型定制，比现有技术更准确，重量更轻。总结我们的主要发现，我们收集到（i）虽然ML和DL模型都同样能够为已知流量的分类提供令人满意的解决方案，然而（ii）DL主干的非线性特征提取过程为未知类别的检测提供了相当大的优势。
英文摘要：
The increasing success of Machine Learning (ML) and Deep Learning (DL) has recently re-sparked interest towards traffic classification. While classification of known traffic is a well investigated subject with supervised classification tools (such as ML and DL models) are known to provide satisfactory performance, detection of unknown (or zero-day) traffic is more challenging and typically handled by unsupervised techniques (such as clustering algorithms). In this paper, we share our experience on a commercial-grade DL traffic classification engine that is able to (i) identify known applications from encrypted traffic, as well as (ii) handle unknown zero-day applications. In particular, our contribution for (i) is to perform a thorough assessment of state of the art traffic classifiers in commercial-grade settings comprising few thousands of very fine grained application labels, as opposite to the few tens of classes generally targeted in academic evaluations. Additionally, we contribute to the problem of (ii) detection of zero-day applications by proposing a novel technique, tailored for DL models, that is significantly more accurate and light-weight than the state of the art. Summarizing our main findings, we gather that (i) while ML and DL models are both equally able to provide satisfactory solution for classification of known traffic, however (ii) the non-linear feature extraction process of the DL backbone provides sizeable advantages for the detection of unknown classes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
