Anti-concept Drift-enabled Recognition Method of Encrypted Traffic Behavior

Although encrypted traffic ensures information security, it can also be exploited by malicious actors, leading to security risks. This paper addresses the limitations of existing behavior recognition technologies, particularly the concept drift issue in the "training-testing" phase. We propose an Anti-Concept Drift Framework (ACD-WFP), which includes a Confusion-Aware Adversarial Concept Drift Detection Algorithm (CACD) and an Incremental Learning-Based Multi-Modal Behavior Recognition Algorithm (IM-WFP). In experiments involving 75GB of encrypted traffic across 12 concept drift scenarios, CACD efficiently detects and tracks drift with low storage requirements, while IM-WFP improves recognition accuracy by 2% to 22% through continuous learning of new concepts.