Balancing Complexity and Performance in Convolutional Neural Network Models for QUIC Traffic Classification.

As the network goes deep into all aspects of people''s lives, the number and the complexity of network traffic is increasing, and traffic classification becomes more and more important. How to classify them effectively is an important prerequisite for network management and planning, and ensuring network security. With the continuous development of deep learning, more and more traffic classification begins to use it as the main method, which achieves better results than traditional classification methods. In this paper, we provide a comprehensive review of network traffic classification based on deep learning. Firstly, we introduce the research background and progress of network traffic classification. Then, we summarize and compare traffic classification based on deep learning such as stack autoencoder, one-dimensional convolution neural network, two-dimensional convolution neural network, three-dimensional convolution neural network, long short-term memory network and Deep Belief Networks. In addition, we compare traffic classification based on deep learning with other methods such as based on port number, deep packets detection and machine learning. Finally, the future research directions of network traffic classification based on deep learning are prospected.

Recently, with the advent of various Internet of Things (IoT) applications, a massive amount of network traffic is being generated. A network operator must provide different quality of service, according to the service provided by each application. Toward this end, many studies have investigated how to classify various types of application network traffic accurately. Especially, since many applications use temporary or dynamic IP or Port numbers in the IoT environment, only payload-based network traffic classification technology is more suitable than the classification using the packet header information as well as payload. Furthermore, to automatically respond to various applications, it is necessary to classify traffic using deep learning without the network operator intervention. In this study, we propose a traffic classification scheme using a deep learning model in software defined networks. We generate flow-based payload datasets through our own network traffic pre-processing, and train two deep learning models: 1) the multi-layer long short-term memory (LSTM) model and 2) the combination of convolutional neural network and single-layer LSTM models, to perform network traffic classification. We also execute a model tuning procedure to find the optimal hyper-parameters of the two deep learning models. Lastly, we analyze the network traffic classification performance on the basis of the F1-score for the two deep learning models, and show the superiority of the multi-layer LSTM model for network packet classification.

Network traffic classification technologies could be used by attackers to implement network monitoring and then launch traffic analysis attacks or website fingerprint attacks. In order to prevent such attacks, a novel way to generate adversarial samples of network traffic from the perspective of the defender is proposed. By adding perturbation to the normal network traffic, a kind of adversarial network traffic is formed, which will cause misclassification when the attackers are implementing network traffic classification with deep convolutional neural networks (CNN) as a classification model. The paper uses the concept of adversarial samples in image recognition for reference to the field of network traffic classification and chooses several different methods to generate adversarial samples of network traffic. The experiment, in which the LeNet‐5 CNN is selected as a classification model used by attackers and Vgg16 CNN is selected as the model to test the transferability of the adversarial network traffic generated, shows the effect of the adversarial network traffic samples.

Internet of Things (IoT) systems are rightly receiving considerable interest for many real-world applications, from in-body networks to satellite networks. Such a massive-scale system generates a considerable amount of traffic data, making IoT systems a distributed data source generator. For many reasons, such as the functionality of IoT applications and Quality of Service (QoS) provisioning, classifying these traffic data is of high importance. In the last few years, widespread interest has been expressed in applying Machine Learning (ML)-based techniques for Network Traffic Classification (NTC) tasks. However, the traditional centralized learning-based traffic classifiers pose serious challenges, especially in IoT networks. The centralized ML techniques call for collecting a large amount of data from various IoT devices, which in turn introduces data governance and privacy challenges. Furthermore, in the centralized ML, training data need to be transferred to the Cloud, which increases communication cost and latency. To address these problems, we propose Federated Learning (FL) Internet of Things (IoT) Traffic Classifier (FLITC)-a Federated Learning (FL)-based IoT traffic classification method which is based on the Multi-Layer Perception (MLP) neural network and holds the local data unimpaired on IoT devices by sending only the learned parameters to the aggregation server. Our experimental results show that the FLITC beats centralized learning in preserving the privacy of sensitive data and offers a better degree of accuracy at the cost of a longer training time.

Network traffic classification for data fusion: A survey

Malicious traffic classification has become a challenge in modern communications. It is a very important task for a trained model to successfully distinguish malicious traffic. With the gradual application of machine learning and deep learning in the field of traffic classification, traffic classification has reached a high accuracy rate. Feature selection can lighten models and improve classification performance by selecting the optimal sub-feature set. Therefore, the selection of effective features is an important issue for malicious traffic classification. In this article, we propose the idea of applying feature selection methods Information Gain and RFE to malicious traffic classification. The essence is to select an effective and optimal sub-feature set from a large number of features to characterize network traffic. Then, we used the deep learning method CNN and the machine learning method RF on the three real network traffic datasets of CICIDS2017, NSL-KDD and UNSW-NB15 respectively to evaluate and verify. The experiment shows that the combination of CNN and Information Gain has the best effect. The results of many experiments show that the performance of traffic classification is greatly improved after feature selection.

Identification of crops is an important topic in the agricultural domain. Hyperspectral remote sensing data are very useful for crop feature extraction and classification. Remote sensing data is an unstructured data and Convolutional Neural Network (CNN) can work on unstructured data efficiently. This paper presents an evaluation of CNN for crop classification using the Indian Pines standard dataset obtained from the AVIRIS sensor and the study area dataset obtained from the EO-1hyperion sensor. Optimized CNN has been tuned by training the model on different parameters. It has been compared with two classification algorithms: Deep Neural Network (DNN) and Convolutional Autoencoder. According to the test results, the proposed optimized CNN model provided better results as compared to the other two methods. CNN has given 97 ± 0.58% overall accuracy for the Indian Pines standard dataset and 78 ± 2.43% for our study area dataset.

Smart objects have grown in popularity and acceptance over the past period due to their decreasing size, greater intelligence, and lower costs. The Internet of Things (IoT) connects physical devices, including actuators, sensors, and cameras, to a network via the Internet. The widespread use of IoT devices has led to an exponential rise in network traffic volume and complexity, creating new challenges for real-time network security and threat detection. This study attempts to design an intrusion detection system which is scalable and capable of handling the vast number and variety of IoT traffic. It is based on improving the scalability and precision of the detection of threats by employing machine learning (ML) and deep learning (DL) techniques and hybrid model. The model is trained and tested on the CIC IoT DIAD 2024 dataset, a large high-volume dataset consisting of diversified IoT traffic, benign and malicious activity. It includes extensive data preprocessing, feature selection, and training of various models. Features were selected using an Analysis of Variance (ANOVA)–based feature selection technique to reduce computational overhead and time complexity while mitigating the curse of dimensionality and enhancing model accuracy. The resulting optimal feature subset was then used to train and evaluate several classifiers, including Decision Trees, K-Nearest Neighbors (KNN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and a hybrid CNN–LSTM model. The models are compared using typical measures of performance such as accuracy, precision, recall, F1-score, and confusion matrix. The results indicate that hybrid deep learning models specifically the CNN-LSTM outperformed the other models in recognizing binary attacks achieving the highest performance with accuracy of 94.08% followed by CNN and LSTM with accuracies of 93.37% and 93.24% respectively. In contrast, the traditional machine learning model, Decision trees demonstrated superior performance in multi-class classification, achieving an accuracy of 98.25% defeating KNN (90%) as well as the hybrid deep learning model (CNN-LSTM – 88.30%). This, work paves the foundation for the implementation of scalable intrusion detection models in real IoT infrastructures. The future of the work is to integrate the developed models using massive data streaming infrastructures in support of real-time intrusion detection in large-scale, dynamic IoT infrastructures.

Internet traffic is experiencing rapid growth, with the majority of traffic generated from video steaming, web data services and Internet of Things. As these services include the transmission of small data, such as web pages, video chunks and sensing data, data latency affects the quality of experience rather than the throughput. Therefore, this study aims to decrease latency to improve the quality of the user experience. To this end, we measure the web service delay and throughput in mobile networks. The results indicate a low quality experience for mobile users, even though mobile networks support a large throughput. We therefore propose a light-weight latency reduction scheme for the Quick UDP Internet Connections (QUIC) protocol. The proposed scheme calculates the average congestion window, which is utilized as the initial congestion window when a new connection is established. The proposed scheme is evaluated through experiments on a testbed. The results show that our scheme reduces latency significantly. The results of this study can help improve user experiences of video streaming and web data services.

The purpose of this paper is to explore the role of Machine Learning (ML) in fortifying the security of cloudbased Internet of Things (IoT) systems, using a comprehensive security management approach. The methodological approach involved comparing different ML techniques such as Decision Trees, Random Forest, Support Vector Machines, and Convolutional Neural Networks. Their effectiveness was evaluated based on the accuracy of threat detection in cloud-based IoT systems. The findings revealed that Convolutional Neural Networks demonstrated the highest accuracy rate (98%) in threat detection, thereby significantly enhancing the security of IoT systems. It also identified improvements in threat detection, prevention, response, and system recovery across all ML techniques. Research limitations were primarily the rapidly evolving nature of both ML and IoT technologies, necessitating continual reassessments. The scope was also limited to cloud-based IoT systems, leaving room for further research on other types of IoT systems. The practical implications included improved system security, which could lead to increased trust and wider adoption of IoT technology in various sectors, from healthcare to home security. The social implications entail a safer digital environment, contributing to data privacy and reducing the risk of cyber threats for individuals and communities. The originality of this paper lies in its comprehensive approach to IoT security management using ML, providing valuable insights into the effectiveness of different ML techniques in enhancing threat detection accuracy.

The report presents an algorithm for constructing a convolutional hierarchical neural network classifier, which is a modification of the algorithm for constructing hierarchical neural network classifiers suggested before. The original algorithm was designed to exploit intrinsic class hierarchy to build a class tree with a neural network in each node classifying groups of initial classes (in a non-terminal node) or a subset of original classes (in a terminal node). The convolutional modification utilizes convolutional neural networks instead of regular fully connected networks in order to apply the model to image classification tasks. Use of class hierarchy for image classification should reduce the number of adjusted neural network parameters compared to deep convolutional neural networks, and therefore it should reduce training and inference time. In this context the algorithm may be compared with some pruning techniques. The convolutional hierarchical neural network classifier inherits some hyperparameters of a conventional hierarchical neural network classifier, like the activation threshold and the threshold by the share of voting patterns. The goal of this study was to explore different strategies of choosing these hyperparameters. To test these strategies, we used the CIFAR-10 dataset. Also, for demonstration purposes we apply the convolutional hierarchical neural network classifier to the CIFAR-100 dataset.

Accurate network traffic classification is essential for network management. However, existing network traffic classification methods cannot meet the demand of real networks in terms of classification performance, user privacy, latency, and control overhead. Thus, a machine learning-based approach has been used for network traffic classification. In this paper, we propose a network traffic classification framework using software-defined network (SDN) architecture. The proposed framework is entirely located in the network controller; thus, we can leverage the superior computational capacity, global visibility, and programmability of the SDN controller to realize real-time, adaptive, and accurate traffic classification. We also apply four ensemble algorithms and analyze their classification performance in terms of accuracy, precision, recall, F1-score, training time, and classification time. The experimental results reveal that ensemble model-based network traffic classifiers outperform other classifiers based on the proposed framework and the real-world network traffic dataset. Notably, the LightGBM model achieves the best classification performance.

The Internet of Things (IoT) has transformed various sectors by enabling connectivity and automation through smart devices. However, the expansion of IoT networks has introduced new security challenges, particularly concerning the detection and prevention of cyber threats. This study explores the application of machine learning (ML) models for enhancing network security in IoT-enabled smart systems. The primary objective was to evaluate the performance of different ML algorithms, including Convolutional Neural Networks (CNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), K-Means, and Autoencoder, in detecting and mitigating security threats in IoT environments. The study also aimed to identify the most effective model in terms of accuracy, precision, recall, and F1-score. The research methodology involved training and testing these models on publicly available IoT security datasets, followed by performance evaluation based on the key metrics. Statistical analysis, including One-Way ANOVA and post-hoc testing, was used to assess the significance of the performance differences across the models. The results revealed that CNN outperformed all other models, achieving the highest accuracy (96.7%), precision (95.8%), recall (97.2%), and F1-score (96.5%). Random Forest also demonstrated strong performance with an accuracy of 95.6% and a balanced evaluation across all metrics. In contrast, traditional models like SVM and DT showed comparatively lower performance, while Autoencoder struggled with classification tasks, particularly in real-time threat detection. Statistical analysis confirmed the significant differences in model performance. In conclusion, the study demonstrates the effectiveness of deep learning and ensemble models, particularly CNN and Random Forest, in enhancing IoT network security. The research highlights the importance of selecting the appropriate ML model based on the specific requirements of the IoT environment and computational constraints, and suggests that hybrid models and model optimization strategies may offer promising solutions for resource-constrained IoT systems.

Convolutional Neural Networks (CNNs) have become the most used and efficient way to identify and classify objects in a scene. CNNs are today fundamental not only for autonomous vehicles, but also for Internet of Things (IoT) and smart cities or smart homes. Vendors are developing low-power, efficient, and low-cost dedicated accelerators to allow the execution of the computational-demanding CNNs even in embedded applications with strict power and cost budgets. Google's Coral Tensor Processing Unit (TPU) is one of the latest low power accelerators for CNNs. In this paper we investigate the reliability of TPUs to atmospheric neutrons, reporting experimental data equivalent to more than 30 million years of natural irradiation. We analyze the behavior of TPUs executing atomic operations (standard or depthwise convolutions) with increasing input sizes as well as eight CNN designs typical of embedded applications, including transfer learning and reduced data-set configurations. We found that, despite the high error rate, most neutrons-induced errors only slightly modify the convolution output and do not change the CNNs detection or classification. By reporting details about the fault model and error rate, we provide valuable information on how to evaluate and improve the reliability of CNNs executed on a TPU.

Privacy information theft traffic is usually detected using traffic classification methods, and deep learning-based detection methods are effective for this task. However, these methods have complex preprocessing processes as well as tend to ignore the deep features of network traffic, while the generalization ability is not outstanding. In this paper, a network traffic classification and detection model TCCN (Traffic Classification Capsule Network) based on capsule network is proposed. Meanwhile, PacketCGAN-based data balancing method is introduced to assist TCCN in traffic classification. A new feature graph vectorization method is used to improve the efficiency of TCCN. In addition, TCCN uses dynamic routing mechanism that can retain more valid traffic characteristics. In parallel, this paper proposes a new loss function to improve the generalization performance of TCCN. The results show that TCCN can show good performance in different experimental scenarios. After effective training, TCCN can also show high detection accuracy in new datasets, and the generalization ability of the model reaches a relatively excellent level.