Encrypted Traffic Identification in Power IoT based on CNN with Batch Normalization

With the rapid development of new power system, encrypted traffic in power IoT has surged. How to effectively identify encrypted traffic has become a new challenge for industrial control security detection. Traditional machine learning-based traffic identification methods, which rely on manually designed classification features, often suffer from limited classification accuracy. In order to solve this problem, this paper adopts deep learning technology to construct a batch normalized 1D-CNN model for encrypted traffic identification, considering the one-dimensional sequence characteristics of network traffic. This model encompasses a comprehensive process, including feature extraction, feature selection, and classification. By incorporating batch normalization layers, the model ensures good stability in sample data and sustains an accelerated convergence speed for deep networks. Extensive experiments have been conducted on encrypted traffic captured from real power IoT and public VPN encrypted traffic. The results demonstrate that compared with the C 4.5 model and other CNN models such as the 1D-CNN, 2D-CNN, and batch-normalized 2D-CNN, the batch-normalized 1D-CNN model exhibits superior performance in encrypted traffic identification, achieving an accuracy rate of $\mathbf{9 3. 9 9 \%}$.