Title: An Enhanced Encrypted Traffic Classifier via Combination of Deep Learning and Automata Learning

Abstract: Characterizing the network traffic and identifying running applications play an instrumental role in several network administration tasks such as protecting against malicious behavior, firewalling, and balancing bandwidth usage. This classification is complex due to recent advances in the Internet, such as encryption-based security protocols, Tor networks, and virtual private networks. We propose a general traffic classifier that addresses all the above-mentioned challenges. We utilize the automata learning technique to derive the behavioral packet-based model of each application in terms of a k-testable language. The corresponding automaton shows the temporal relations among the packets and can be automatically learned from a set of application traces. As some packets always appear together, we apply machine learning techniques to automatically identify those packets with similar timing and statistical features to increase the granularity of the alphabets of the learned languages. This leads to smaller models yet still precise to characterize applications. The learned models are very precise and too sensitive to the order of the packets which leads to overfitting and not tolerable to noise and events loss or reordering in the distributed setting. We classify the packets by a deep neural network trained through the feature vectors extracted from the learned languages. The results of applying our framework on real traffic indicate that our approach outperforms the state-of-the-art methods both in application identification and traffic characterization tasks. The proposed approach is also resilient to noise stemming from the simultaneous execution of multiple applications.