Continuous Select-and-Prune Incremental Learning for Encrypted Traffic Classification in Distributed SDN Networks

Traffic classification plays an indispensable role in Computer Networks and the Internet of Things. As the cybersecurity landscape evolves, a diverse array of encrypted protocols (e.g., HTTPS, GQUIC, and TLS) is becoming increasingly prevalent. Alongside this, the challenge of encrypted traffic classification has garnered renewed attention, fostered by the increasing adoption of Deep Learning (DL) methodologies. Nonetheless, the fast-paced release of new encrypted protocols necessitates frequent retraining of DL models on reformed datasets encompassing encrypted traffic from both known and unknown applications. This requirement can lead to the issues of catastrophic forgetting, particularly when classifying unknown applications. To address this shortcoming, we propose a novel two-stage Incremental Learning (IL) paradigm based on flow-exemplar selection strategy and model pruning, CoSP, to enable continuous model evolution with unknown applications. Extensive experiments on encrypted traffic datasets in a Software-defined networking environment illustrate that our method outperforms other IL approaches, achieving 1.07% and 0.94% improvements in last accuracy and forgetting, respectively.