基於深度學習與知識蒸餾的加密網路流量分類方法

Abstract

網路流量分類在網路安全中扮演著至關重要的角色，其重要性日益增加。網路流量分類是指辨識和分類網路中的各種封包或流量的過程。該分類方法通常基於流量的類型、特徵和行為模式，從而有助於檢測潛在威脅並採取必要措施來進行緩解。因此，它對網路安全和監控至關重要。如今，超過 90% 的網頁使用 HyperText Transfer Protocol Secure (HTTPS) 加密，以確保資料隱私和應用程式之間的通訊安全。傳統常見的網路流量分類做法如：基於通訊埠編號 (Port-based) 分類或深度封包檢測 (Deep Packet Inspection, DPI) 的方法在面對加密網路流量時已逐漸難以應用。在本論文中，我們提出了一種基於深度學習和知識蒸餾的加密網路流量分類方法。我們使用具有三層卷積層的一維卷積神經網路 (1D-CNN)作為教師模型，來訓練僅有一層卷積層的學生模型。我們分別採用標準一維卷積神經網路和深度可分離一維卷積神經網路作為教師模型。這些教師模型的輸出隨後被用作訓練數據，通過知識蒸餾方法來訓練僅包含一層卷積層的學生模型，以驗證知識蒸餾的有效性。實驗結果表明，知識蒸餾可促使標準和深度可分離兩種學生模型均能從教師模型的輸出中學習，在保持與教師模型相當的準確度的同時，減少了模型大小和推理時間。此外，我們的實驗結果顯示相較於標準一維卷積神經網路，深度可分離一維卷積神經網路減少了參數量並達到了更小的模型尺寸與更少的模型渲染時間，從而實現了更好的效率。

Network traffic classification plays a crucial role in network security and its importance has grown significantly. Network traffic classification involves identifying and categorizing various data packets or flows within a network. This classification is typically based on the flow type, features and behavioral patterns of the traffic, which aids in detecting potential threats and taking necessary measures to mitigate them. Therefore, it is vital for network security and monitoring. Nowadays, over 90% of webpages are encrypted using HyperText Transfer Protocol Secure (HTTPS) to ensure data privacy and secure communication between applications. Traditional network traffic classification methods such as Port-Based classification or Deep Packet Inspection (DPI) have gradually become impractical for encrypted network traffic. In this thesis, we propose a classification method for encrypted network traffic based on deep learning and knowledge distillation. We used a one-dimensional convolutional neural network (1D-CNN) with three convolutional layers as the teacher model to train the student model with only one convolutional layer. We employed both a standard 1D-CNN and a depthwise separable 1D-CNN as teacher models. The outputs of these teacher models were then used as training data. Through the process of knowledge distillation, we trained the student model with a single convolutional layer to validate the effectiveness of knowledge distillation. Simulation results indicate that knowledge distillation enables both the standard and separable student models to learn from the teacher models’ outputs, reducing model size and inference time while maintaining accuracy comparable to more complicated teacher models. Furthermore, our experiments demonstrate that the separable 1D-CNN achieves a smaller model size and shorter inference time when it is compared with the standard 1D-CNN, thereby achieving better efficiency.