Identifying the type of a network flow or a specific application has many advantages, such as, traffic engineering, or to detect and prevent application or application types that violate the organization’s security policy. The use of encryption, such as VPN, makes such identification challenging. Current solutions rely mostly on handcrafted features and then apply supervised learning techniques for the classification. We introduce a novel approach for encrypted Internet traffic classification and application identification by transforming basic flow data into an intuitive picture, a FlowPic, and then using known image classification deep learning techniques, CNNs, to identify the flow category (browsing, chat, video, etc.) and the application in use. We show that our approach can classify traffic with high accuracy, both for a specific application, or a flow category, even for VPN and Tor traffic. Our classifier can even identify with high success new applications that were not part of the training phase for a category, thus, new versions or applications can be categorized without additional training.

中文翻译：

---

FlowPic：加密流量分类和应用程序识别的通用表示


识别网络流或特定应用程序的类型有很多优点，例如流量工程，或者检测和防止违反组织安全策略的应用程序或应用程序类型。 VPN 等加密技术的使用使得这种识别变得具有挑战性。当前的解决方案主要依赖于手工制作的特征，然后应用监督学习技术进行分类。我们引入了一种加密互联网流量分类和应用识别的新方法，将基本流量数据转换为直观的图片（FlowPic），然后使用已知的图像分类深度学习技术（CNN）来识别流量类别（浏览、聊天、视频、等）和正在使用的应用程序。我们表明，我们的方法可以高精度地对流量进行分类，无论是针对特定应用程序还是流量类别，甚至对于 VPN 和 Tor 流量也是如此。我们的分类器甚至可以非常成功地识别不属于某个类别培训阶段的新应用程序，因此，无需额外培训即可对新版本或应用程序进行分类。