GMTBLC: a deep learning-based bi-modal network traffic classification method

Network traffic classification is crucial for network security maintenance and management, and it has been widely applied in tasks, such as quality of service (QoS) assurance and intrusion detection. To address the issues of traditional traffic classification models, such as insufficient feature extraction and low classification accuracy, a dual-modal network traffic classification method based on group mix attention (GMA) with a transformer and a bi-directional long short-term memory (Bi-LSTM) network, named group mix transformer and Bi-LSTM for traffic classification (GMTBLC), was proposed. In the data preprocessing phase, packet-level images within sessions were generated from the payloads of data packets to reduce information interference. In the classification phase, the images were firstly processed by the packet group mix transformer (PCMT) module, which utilized the transformer and GMA to capture global features. Simultaneously, session images were processed by the spatio-temporal feature extraction (SFE) module, of which the spatial features of packets were extracted by a convolutional neural network with residual connections, and temporal features of packets were extracted by a bi-directional long short-term memory network. In the fusion classification layer, the above global and spatiotemporal features were integrated using a dynamic weighting mechanism to complete network traffic classification. Experimental results on ISCX and USTC-TFC2016 datasets demonstrate that the proposed model achieves a classification accuracy of 99.31%, with precision, recall, and F1-score all above 98%, and outperforms the other models in classification effectiveness.