Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques

TL;DR

This work tackles encrypted Internet Traffic Classification (ITC) under data scarcity and MTU variability by introducing two data augmentation techniques: Average augmentation, which creates new samples by averaging $m$ same-class flows to expand the data, and MTU augmentation, which simulates different MTU values by fragmenting packets. The paper demonstrates that Average augmentation can boost classifier performance through a transfer-learning–style fine-tuning pipeline, while MTU augmentation improves robustness to MTU changes and mitigates reliance on a fixed MTU. Evaluations on three datasets, including two public QUIC datasets and a commercial FLASH dataset, show improvements in F1-scores and reveal the trade-offs between augmentation strategies, with notable gains in MTU-robustness. Overall, the results highlight data augmentation as a viable approach to enhance QoE/QoS in encrypted traffic classification and advocate further exploration of ITC-tailored augmentation parameters and applications.

Abstract

The increasing popularity of online services has made Internet Traffic Classification a critical field of study. However, the rapid development of internet protocols and encryption limits usable data availability. This paper addresses the challenges of classifying encrypted internet traffic, focusing on the scarcity of open-source datasets and limitations of existing ones. We propose two Data Augmentation (DA) techniques to synthetically generate data based on real samples: Average augmentation and MTU augmentation. Both augmentations are aimed to improve the performance of the classifier, each from a different perspective: The Average augmentation aims to increase dataset size by generating new synthetic samples, while the MTU augmentation enhances classifier robustness to varying Maximum Transmission Units (MTUs). Our experiments, conducted on two well-known academic datasets and a commercial dataset, demonstrate the effectiveness of these approaches in improving model performance and mitigating constraints associated with limited and homogeneous datasets. Our findings underscore the potential of data augmentation in addressing the challenges of modern internet traffic classification. Specifically, we show that our augmentation techniques significantly enhance encrypted traffic classification models. This improvement can positively impact user Quality of Experience (QoE) by more accurately classifying traffic as video streaming (e.g., YouTube) or chat (e.g., Google Chat). Additionally, it can enhance Quality of Service (QoS) for file downloading activities (e.g., Google Docs).

Figures (6)

• Figure 1: This workflow illustrates how new samples are extracted for each subgroup of size $m$ for any class $C$
• Figure 2: A comparison between training model with and without our average augmentation. In all tests, the test set is composed of the original samples. The Model: Original model was solely trained on the original dataset, whereas the second model was trained on both the original dataset and the average augmentation.
• Figure 3: Comparing performance decline with MTU lower than 1500. In both cases, we used the same model trained on the Original dataset and changed the test dataset. Test: Original is the Original test samples, and Test: MTU is the simulated reduced MTU samples.
• Figure 4: QUIC Davis Dataset
• Figure 5: Flash Dataset