Classifying encrypted traffic using quad-directional convolution on pulse sequences

Abstract With the growing concerns for user privacy and communication security, the volume of encrypted traffic has surged, making accurate classification of encrypted traffic crucial. Current mainstream classification methods primarily rely on handcrafted features and machine learning techniques. However, these features often depend on expert knowledge and require substantial human resources. Additionally, using simple features can lead to inadequate feature extraction. To address these challenges, we have developed the Pulse-Driven Quad-Directional Temporal Convolutional Network. A core innovation of this model is transforming one-dimensional packet length sequences into two-dimensional pulse sequences, significantly enhancing the feature representation capability and classification accuracy of the model. Furthermore, the model employs forward, backward, middle-outward, and both-ends-inward temporal convolutions to effectively extract global features. Coupled with the self-attention mechanism, the model deeply explores the dependencies among features, greatly enhancing classification accuracy and robustness. On the public CESNET-TLS22 dataset, this method achieved an F1 score of 99.24% in the classification of five application services and an average F1 score of 98.74% in the 20-application classification test. Additionally, on the UNB ISCX dataset, tests on VPN and Tor traffic also demonstrated outstanding performance, with F1 scores exceeding 98%. These results highlight the precision and effectiveness of this method across various application scenarios.