A novel network traffic classification approach via discriminative feature learning

Network traffic classification technologies could be used by attackers to implement network monitoring and then launch traffic analysis attacks or website fingerprint attacks. In order to prevent such attacks, a novel way to generate adversarial samples of network traffic from the perspective of the defender is proposed. By adding perturbation to the normal network traffic, a kind of adversarial network traffic is formed, which will cause misclassification when the attackers are implementing network traffic classification with deep convolutional neural networks (CNN) as a classification model. The paper uses the concept of adversarial samples in image recognition for reference to the field of network traffic classification and chooses several different methods to generate adversarial samples of network traffic. The experiment, in which the LeNet‐5 CNN is selected as a classification model used by attackers and Vgg16 CNN is selected as the model to test the transferability of the adversarial network traffic generated, shows the effect of the adversarial network traffic samples.

PMANet: Progressive multi-stage attention networks for skin disease classification

Deep learning has been applied in the field of network intrusion detection and has yielded good results. In malicious network traffic classification tasks, many studies have achieved good performance with respect to the accuracy and recall rate of classification through self-designed models. In deep learning, the design of the model architecture greatly influences the results. However, the design of the network model architecture usually requires substantial professional knowledge. At present, the focus of research in the field of traffic monitoring is often directed elsewhere. Therefore, in the classification task of the network intrusion detection field, there is much room for improvement in the design and optimization of the model architecture. A neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal. For this reason, we propose a model that can perform NAS in the field of network traffic classification and search for the optimal architecture suitable for traffic detection based on the network traffic dataset. Each layer of our depth model is constructed according to the principle of maximum coding rate attenuation, which has strong consistency and symmetry in structure. Compared with some manually designed network architectures, classification indicators, such as Top-1 accuracy and F1 score, are also greatly improved while ensuring the lightweight nature of the model. In addition, we introduce a surrogate model in the search task. Compared to using the traditional NAS model to search the network traffic classification model, our NAS model greatly improves the search efficiency under the premise of ensuring that the results are not substantially different. We also manually adjust some operations in the search space of the architecture search to find a set of model operations that are more suitable for traffic classification. Finally, we apply the searched model to other traffic datasets to verify the universality of the model. Compared with several common network models in the traffic field, the searched model (NAS-Net) performs better, and the classification effect is more accurate.

Accurate network traffic classification is essential for network management. However, existing network traffic classification methods cannot meet the demand of real networks in terms of classification performance, user privacy, latency, and control overhead. Thus, a machine learning-based approach has been used for network traffic classification. In this paper, we propose a network traffic classification framework using software-defined network (SDN) architecture. The proposed framework is entirely located in the network controller; thus, we can leverage the superior computational capacity, global visibility, and programmability of the SDN controller to realize real-time, adaptive, and accurate traffic classification. We also apply four ensemble algorithms and analyze their classification performance in terms of accuracy, precision, recall, F1-score, training time, and classification time. The experimental results reveal that ensemble model-based network traffic classifiers outperform other classifiers based on the proposed framework and the real-world network traffic dataset. Notably, the LightGBM model achieves the best classification performance.

As an essential task for network management and security, network traffic classification has attracted increasing attention in recent years. Traditional traffic classification methods achieve certain success in identifying specific application traffic but fail with un-predefined unknown classes. Existing unknown traffic discovery methods commonly pick out some unlabeled testing data as part of training data to train the classification models, which is not in line with the real-world open environments. In this paper, we propose a novel scheme named SEEN to achieve unknown traffic detection in network traffic classification. There are three crucial phases in the SEEN: unknown discovery, unknown clustering, and system update. In the first step, using a metric-based approach with siamese network, SEEN identifies unknown traffic as well as accurately classifies the traffic generated by pre-defined application classes. After discovery, unknown traffic is automatically clustered into more fine-grained categories in the unknown clustering step. In the system update step, inspired by low-shot learning, SEEN allows new classes to be added or unnecessary known classes to be deleted quickly without retraining from the sketch, which can complement the system’s knowledge. Experimental results exhibit that SEEN can achieve outstanding performances both on known and unknown traffic identification on two open real-world datasets, and the proposed scheme can address the problem of unknown traffic effectively.

In this paper, we present a deep coupled framework to address the problem of matching sketch image against a gallery of mugshots. Face sketches have the essential information about the spatial topology and geometric details of faces while missing some important facial attributes such as ethnicity, hair, eye, and skin color. We propose a coupled deep neural network architecture which utilizes facial attributes in order to improve the sketch-photo recognition performance. The proposed Attribute-Assisted Deep Convolutional Neural Network (AADCNN) method exploits the facial attributes and leverages the loss functions from the facial attributes identification and face verification tasks in order to learn rich discriminative features in a common embedding subspace. The facial attribute identification task increases the inter-personal variations by pushing apart the embedded features extracted from individuals with different facial attributes, while the verification task reduces the intra-personal variations by pulling together all the features that are related to one person. The learned discriminative features can be well generalized to new identities not seen in the training data. The proposed architecture is able to make full use of the sketch and complementary facial attribute information to train a deep model compared to the conventional sketch-photo recognition methods. Extensive experiments are performed on composite (E-PRIP) and semi-forensic (IIIT-D semi-forensic) datasets. The results show the superiority of our method compared to the state-of-the-art models in sketch-photo recognition algorithms.

The co-occurrence features learned through mining methods have more discriminative power to separate images from other categories than individual low-level features. However, the pattern explosion problem involved in mining process prevents its application in many visual tasks. In this paper, we propose a novel scheme to learn discriminative features based on a mined optimal model. The proposed method deals with the pattern explosion problem from two aspects, 1 it uses selected weak semantic patches instead of grid patches to substantially reduce the database to mine; 2 the adopted optimal model can produce compact and representative patterns which make the resulted image code more effective and discriminative for classification. In our work, we apply the minimal description length MDL to mine the optimal model. We evaluate the proposed method on two publicly available datasets 15-Scenes and Oxford-Flowers17 and the experimental results demonstrate its effectiveness.

Few-shot traffic sign recognition with clustering inductive bias and random neural network

Target detection (TD) is one of the major tasks in hyperspectral image (HSI) processing, and its performance is greatly affected by the background. Feature extraction (FE) has been an effective way to mine discriminative information, especially FE based on deep learning, which can learn the intrinsic properties of data to further improve the detection performance. Unlike supervised networks, unsupervised stacked sparse autoencoders (SSAEs) can learn deep and nonlinear features without any labeled data. However, SSAEs usually require a supervised fine-tuned model to obtain better discrimination, which is not feasible for TD, since the prior information is generally insufficient. In this letter, we introduce a distance constraint that is added to the SSAE to form a new distance constrained SSAE (DCSSAE) network. Specifically, the distance constraint maximizes the distinction between the target pixels and other background pixels in the feature space. Then, using the discriminative features learned from the DCSSAE, a simple detector using radial basis function kernel is derived for background suppression. Experiments on two HSIs demonstrate that the deep spectral features learned from the DCSSAE are more distinguishable, and our proposed detector, namely, the DCSSAE detector, outperforms several popular detectors, especially in background suppression.

Local binary feature learning has attracted a lot of researches in image recognition due to its vital effectiveness. Generally, in the traditional local feature learning methods, a projection is learned to map the patches of image into binary features and then a codebook is generated by clustering the binary features with K-means clustering. However, these local feature learning methods, such as compact binary face descriptor and discriminative binary descriptor, ignore the category specific distributions of the original features during the feature learning process and use the real-valued clustering approach to generate the codebook, the discriminant of feature is degraded and the merits of binary feature are lost. To tack these problems, in this paper, we propose a novel category-preserving binary feature learning and binary codebook leaning (CPBFL-BCL) method for finger vein recognition. In CPBFL-BCL, the discrimination of learned binary features is generated by criteria of fisher discriminant analysis and category manifold preserving regularity during the feature learning process, and a novel binary clustering method based on K-means clustering is designed to generate binary codebook. Experimental results on recognition and retrieval tasks using two public finger vein databases are presented and demonstrate the effectiveness and efficiency of the proposed method over the state-of-the-art finger vein methods and a finger vein retrieval method.

The current state-of-the-art in feature learning relies on the supervised learning of large-scale datasets consisting of target content items and their respective category labels. However, constructing such large-scale fully-labeled datasets generally requires painstaking manual effort. One possible solution to this problem is to employ community contributed text tags as weak labels, however, the concepts underlying a single text tag strongly depends on the users. We instead present a new paradigm for learning discriminative features by making full use of the human curation process on social networking services (SNSs). During the process of content curation, SNS users collect content items manually from various sources and group them by context, all for their own benefit. Due to the nature of this process, we can assume that (1) content items in the same group share the same semantic concept and (2) groups sharing the same images might have related semantic concepts. Through these insights, we can define human curated groups as weak labels from which our proposed framework can learn discriminative features as a representation in the space of semantic concepts the users intended when creating the groups. We show that this feature learning can be formulated as a problem of link prediction for a bipartite graph whose nodes corresponds to content items and human curated groups, and propose a novel method for feature learning based on sparse coding or network fine-tuning.

Key Smart City applications such as traffic management and public security rely heavily on the intelligent processing of video and image data, often in the form of visual retrieval tasks, such as person Re-IDentification (ReID) and vehicle re-identification. For these tasks, Deep Neural Networks (DNNs) have been the dominant solution for the past decade, for their remarkable ability in learning discriminative features from images to boost retrieval performance. However, it is been discovered that DNNs are broadly vulnerable to maliciously constructed adversarial examples. By adding small perturbations to a query image, the returned retrieval results will be completely dissimilar from the query image. This poses serious challenges to vital systems in Smart City applications that depend on the DNN-based visual retrieval technology, as in the physical world, simple camouflage can be added on the subject (a few patches on the body or car), and turn the subject completely untrackable by person or vehicle Re-ID systems. To demonstrate the potential of such threats, this paper proposes a novel adversarial patch generative adversarial network (AP-GAN) to generate adversarial patches instead of modifying the entire image, which also causes the DNNs-based image retrieval models to return incorrect results. AP-GAN is trained in an unsupervised way that requires only a small amount of unlabeled data for training. Once trained, it produces query-specific perturbations for query images to form adversarial queries. Extensive experiments show that the AP-GAN achieves excellent attacking performance with various application scenarios that are based on deep features, including image retrieval, person ReID and vehicle ReID. The results of this study provide a warning that when deploying a DNNs-based image retrieval system, its security and robustness needs to be thoroughly considered.

Network traffic classification is a fundamental research topic on high-performance network protocol design and network operation management. Compared with other state-of-the-art studies done on the network traffic classification, machine learning ML methods are more flexible and intelligent, which can automatically search for and describe useful structural patterns in a supplied traffic dataset. As a typical ML method, support vector machines SVMs based on statistical theory has high classification accuracy and stability. However, the performance of SVM classifier can be severely affected by the data scale, feature dimension, and parameters of the classifier. In this paper, a real-time accurate SVM training model named SPP-SVM is proposed. An SPP-SVM is deducted from the scaling dataset and employs principal component analysis PCA to extract data features and verify its relevant traffic features obtained from PCA. By employing PCA algorithm to do the dimension extraction, SPP-SVM confirms the critical component features, reduces the redundancy among them, and lowers the original feature dimension so as to reduce the over fitting and increase its generalization effectively. The optimal working parameters of kernel function used in SPP-SVM are derived automatically from improved particle swarm optimization algorithm, which will optimize the global solution and make its inertia weight coefficient adaptive without searching for the parameters in a wide range, traversing all the parameter points in the grid and adjusting steps gradually. The performance of its two- and multi-class classifiers is proved over 2 sets of traffic traces, coming from different topological points on the Internet. Experiments show that the SPP-SVM's two- and multi-class classifiers are superior to the typical supervised ML algorithms and performs significantly better than traditional SVM in classification accuracy, dimension, and elapsed time.

Pedestrian detection is an essential and challenging problem in machine vision and video surveillance signal processing. To handle the high cost of training-specific discriminative classifier for pedestrian detection, we focus on the learning of suitable features for pedestrian detection representation. A deep neural network is presented in this paper to resolve the above issue. Our pedestrian detection method has several appealing properties. First, the learning of features is much more efficient under the configuration of the proposed framework due to the reduction of training classifier. Second, a K-Nearest Neighbor (KNN) method is adopted to solve the comparison between the regions of interest and the templates. Third, due to the less dependency of the classifier, the performance across different datasets overcomes most traditional ones. Finally, we perform extensive comparison across different public datasets and compared with corresponding benchmarks.

Investigating features from gait biometric is an essential step for solving human identification problems, medical diagnosis, monitoring and rehabilitation. This chapter addresses the use of a low-cost Kinect V2.0 sensor along with hand-crafted and deep learning techniques for the investigation. As deep neural network is a representation of the most effective machine learning technology in biomedical domain, its usage in this work is extremely significant to determine the accuracy, reliability and feasibility of observational assessments of spatio-temporal features of gait. A novel approach for human detection and tracking is proposed in this chapter, which involves gait feature learning principles from Color Depth videos. A proposed semi-dynamic object tracking algorithm is used to extract the human object. Gait energy image (GEI) representation is exemplified to train a 2D Convolutional Neural Network for automatic feature extraction in one case. In another case, kinematic hip joint angles are extracted via the stick model generated using body aspect ratios. A maximum accuracy of 95.1% is attained from the CNN models, which infers that the gait features automatically extracted are informative enough. Reliability analysis of all features is carried out using statistical methods such as hypothesis testing (T-test as sample size > 30), Kolmogorov-Smirnov (KS) test, Pearson’s r test and energy distance test to ensure feature learning for biometric applications. Almost all the outcomes illustrate that the features come from the same population mean (as critical region value of 0.05 is crossed) and hence are promising for assessing the strategies that impact the inter-record contrasts among motion signatures.