Encryption Traffic Classification Based on Mining Traffic Context and Transport Relationship

This paper proposes a novel ETC-MTCTR, which is designed to enable more accurate, versatile and efficient traffic classification in the context of multi-scenario, low-resource encrypted traffic. Through three modules of Datagram Token conversion, pretraining and fine-tuning, the method uses large-scale unlabeled encrypted traffic for pretraining, mining and learning the traffic context and transmission relationship of encrypted traffic classification tasks, so that a small number of labeled data samples can be effectively used in the fine-tuning stage. Significantly improve the performance of the model on specific downstream classification tasks, enhance the accuracy, adaptability and robustness of the model in diverse environments, limited resources and new encryption security protocols, and realize efficient encryption traffic classification in multi-scenario and low-resource background. The results show that ETC-MTCTR achieves the best performance on three tasks: encryption malware classification, VPN encrypted traffic classification, and TLS 1.3 encryption application classification. Its F1 score is improved by 0.22% in the classification task of encrypted malware, 1.4% in the classification task of VPN encrypted traffic App, 4.56% in the classification task of VPN encrypted traffic Service, and 9.89% in the classification task of TLS 1.3 encrypted application, which is significantly better than other comparison methods.