ET-BERT：一种用于加密流量分类的带有预训练Transformers的上下文数据报表示
ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification
摘要：
加密流量分类需要从内容不可见和不平衡的流量数据中捕获有区别的和鲁棒的流量表示以进行准确的分类，这是具有挑战性的，但对于实现网络安全和网络管理是必不可少的。现有解决方案的主要局限性在于它们高度依赖于深度特征，而深度特征过度依赖于数据大小，并且难以对看不见的数据进行概括。如何利用开放域的未标记交通数据来学习具有较强泛化能力的表示仍然是一个关键挑战。在本文中，我们提出了一个新的流量表示模型，称为加密流量双向编码器表示从Transformer（ET-BERT），预训练深度上下文数据报级表示从大规模的未标记的数据。预训练的模型可以在少量特定于任务的标记数据上进行微调，并在五个加密流量分类任务中实现最先进的性能，将ISCX-Tor的F1显著推高至99.2%（绝对改善4.4%），ISCX-VPN-服务提高到98.9%（绝对提高5.2%），跨平台（Android）提高到92.5%（绝对提高5.4%），CSTNET-TLS 1.3提高到97.4%（绝对提高10.0%）。值得注意的是，我们通过分析密码的随机性来解释经验强大的预训练模型。它为我们理解加密流量的分类能力边界提供了见解。该代码可从以下网址获得：https://github.com/linwhitehat/ET-BERT。
英文摘要：
Encrypted traffic classification requires discriminative and robust traffic representation captured from content-invisible and imbalanced traffic data for accurate classification, which is challenging but indispensable to achieve network security and network management. The major limitation of existing solutions is that they highly rely on the deep features, which are overly dependent on data size and hard to generalize on unseen data. How to leverage the open-domain unlabeled traffic data to learn representation with strong generalization ability remains a key challenge. In this paper,we propose a new traffic representation model called Encrypted Traffic Bidirectional Encoder Representations from Transformer (ET-BERT), which pre-trains deep contextualized datagram-level representation from large-scale unlabeled data. The pre-trained model can be fine-tuned on a small number of task-specific labeled data and achieves state-of-the-art performance across five encrypted traffic classification tasks, remarkably pushing the F1 of ISCX-Tor to 99.2% (4.4% absolute improvement), ISCX-VPN-Service to 98.9% (5.2% absolute improvement), Cross-Platform (Android) to 92.5% (5.4% absolute improvement), CSTNET-TLS 1.3 to 97.4% (10.0% absolute improvement). Notably, we provide explanation of the empirically powerful pre-training model by analyzing the randomness of ciphers. It gives us insights in understanding the boundary of classification ability over encrypted traffic. The code is available at: https://github.com/linwhitehat/ET-BERT.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
