Encrypted Traffic Classification Based on Federated Class Prototype Incremental Learning

Recently, deep learning methods have been widely used to classify encrypted network traffic. But it still faces challenges, such as data privacy and the model's sustainable learning capability. We propose an encrypted traffic classification method based on federated class prototype incremental learning (FPI -ETC). During the local model training phase on the client side, the Softmax classifier of the local model is replaced with a prototype classifier to mitigate the prediction bias associated with the Softmax classifier. In the new task phase, the client utilizes existing class prototype vectors to generate multiple exemplars of the old class, thereby preventing the local model from forgetting previously learned knowledge. The server weighted aggregation of uploaded class prototype vectors for iterative class prototype updates. Experiments demonstrate that FPI -ETC achieves high classification performance in a dynamic encrypted network environment, without requiring the client to store traffic samples.