A High-Accuracy Unknown Traffic Identification Method Based on Multi-View Contrastive Learning

The technology for AI-based encrypted traffic classification (ETC) is advancing rapidly. However, many current studies are conducted in closed network environments where traffic is classified into pre-determined classes. In the actual network environment, new traffic is constantly emerging, making anomaly detection of unknown traffic a pressing issue. The current research attempts different approaches for unknown traffic identification (UTI) from the perspective of model construction, including UTI based on n-classification, UTI based on multiple 2-classifiction, and UTI baed on (n+1)-classification. The above three approaches mentioned are prone to misclassification and have low accuracy due to issues with threshold setting, poor generalization of binary classifiers, and low credibility of generated samples. Researchers have used contrastive learning (CL) for UTI because of its strengths in feature representation. However, there are two shortcomings in the current studies. First, the feature representation of a single view cannot fully capture different classes of traffic features. Second, the existing CL schemes distinguish whether they belong to the same category by constructing pairs of positive and negative samples, but they are still unable to distinguish between known classes and unknown classes in the feature space, resulting in low accuracy. To address the above shortcomings, we propose UTI-MCL, an unknown traffic identification method using multi-view contrastive learning. Firstly, in terms of feature expression, we extract the packet length sequence and the packet byte sequence respectively to learn a more comprehensive feature representation. Secondly, in terms of model construction, we introduce an anchor and compare the distance with both positive and negative samples to help the model better separate different classes in the feature space, enhancing feature distinction. Furthermore, the distance between samples is optimized through the adaptive weights triplet loss function to balance samples from different classes. A series of experiments have proved the effectiveness of UTI-MCL. Even with unknown traffic accounting for 60%, the F<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">β</inf> -Score can still exceed 94%.