An Encrypted Network Traffic Classification Strategy: Combining Locality-Sensitive Hashing With Transformer Encoder and CNN

Encrypted network traffic classification is fundamental for network management and security, including DDoS detection and mitigation. However, unknown category traffic can interfere with the classification of known traffic categories, leading to low recognition rates. To address this issue, we leverage the capability of Locality-Sensitive Hashing (LSH) to efficiently handle high-dimensional traffic data. By mapping similar flows into the same hash buckets with LSH, the unknown category traffic can be filtered out, thereby reducing the interference from unknown category traffic and improving the classification accuracy of known category traffic. Based on this, we propose an LSH-TECNN strategy that combines the LSH with Convolutional Neural Network (CNN) and Transformer Encoder (TE). Firstly, a combination of K-Nearest Neighbors (KNN) and LSH is used to determine whether the traffic belongs to known categories. Then, a Transformer Encoder and 2D-CNN are used to precisely classify the encrypted traffic. Experimental results demonstrate that our method improves classification accuracy by up to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{1 2 \%}$</tex> and precision by up to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$10 \%$</tex> compared to existing encrypted traffic classification methods.