TITLE: Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications 

ABSTRACT: The increasing success of Machine Learning (ML) and Deep Learning (DL) has
recently re-sparked interest towards traffic classification. While
classification of known traffic is a well investigated subject with supervised
classification tools (such as ML and DL models) are known to provide
satisfactory performance, detection of unknown (or zero-day) traffic is more
challenging and typically handled by unsupervised techniques (such as
clustering algorithms).
  In this paper, we share our experience on a commercial-grade DL traffic
classification engine that is able to (i) identify known applications from
encrypted traffic, as well as (ii) handle unknown zero-day applications. In
particular, our contribution for (i) is to perform a thorough assessment of
state of the art traffic classifiers in commercial-grade settings comprising
few thousands of very fine grained application labels, as opposite to the few
tens of classes generally targeted in academic evaluations. Additionally, we
contribute to the problem of (ii) detection of zero-day applications by
proposing a novel technique, tailored for DL models, that is significantly more
accurate and light-weight than the state of the art.
  Summarizing our main findings, we gather that (i) while ML and DL models are
both equally able to provide satisfactory solution for classification of known
traffic, however (ii) the non-linear feature extraction process of the DL
backbone provides sizeable advantages for the detection of unknown classes.
The increasing success of Machine Learning (ML) and Deep Learning (DL) has
recently re-sparked interest towards traffic classification. While
classification of known traffic is a well investigated subject with supervised
classification tools (such as ML and DL models) are known to provide
satisfactory performance, detection of unknown (or zero-day) traffic is more
challenging and typically handled by unsupervised techniques (such as
clustering algorithms).
  In this paper, we share our experience on a commercial-grade DL traffic
classification engine that is able to (i) identify known applications from
encrypted traffic, as well as (ii) handle unknown zero-day applications. In
particular, our contribution for (i) is to perform a thorough assessment of
state of the art traffic classifiers in commercial-grade settings comprising
few thousands of very fine grained application labels, as opposite to the few
tens of classes generally targeted in academic evaluations. Additionally, we
contribute to the problem of (ii) detection of zero-day applications by
proposing a novel technique, tailored for DL models, that is significantly more
accurate and light-weight than the state of the art.
  Summarizing our main findings, we gather that (i) while ML and DL models are
both equally able to provide satisfactory solution for classification of known
traffic, however (ii) the non-linear feature extraction process of the DL
backbone provides sizeable advantages for the detection of unknown classes.
Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications
http://arxiv.org/abs/2104.03182v2