Existing deep learning approaches have achieved high performance in encrypted network traffic analysis tasks. However, practical requirements such as open-set recognition on dynamically changing tasks (e.g., changes in the target website list), challenge existing methods. While few-shot learning and open-set recognition methods have been proposed for domains such as computer vision, few-shot open-set recognition for encrypted network traffic remains an unexplored area. This paper proposes a task adaptive siamese neural network for open-set recognition of encrypted network traffic with bidirectional dropout data augmentation. Our contributions are three-fold: First, we introduce generated positive and negative pairs into the siamese neural network training process to shape a more precise similarity boundary through bidirectional dropout data augmentation. Second, we utilize Dirichlet Process Gaussian Mixture Model (DPGMM) distribution to fit the similarity scores of the negative pairs constructed by the support set of each query task, and create a new open-set recognition metric. Third, by leveraging the extracted features at coarse and fine granular levels, we construct a hierarchical cross entropy loss to improve the confidence of the similarity score. Extensive experiments on a network traffic dataset and the Omniglot dataset demonstrate the superiority and generalizability of our proposed approach.

现有的深度学习方法在加密网络流量分析任务中取得了高性能。然而，诸如对动态变化任务（例如，目标网站列表的变化）的开放集识别等实际要求对现有方法提出了挑战。虽然已经针对计算机视觉等领域提出了少样本学习和开集识别方法，但少样本开集识别对于加密的网络流量仍然是一个未开发的领域。本文提出了一种任务自适应孪生神经网络，用于对具有双向丢失数据增强的加密网络流量进行开放集识别。我们的贡献有三方面：首先，我们将生成的正负对引入孪生神经网络训练过程，通过双向 dropout 数据增强来塑造更精确的相似性边界。其次，我们利用狄利克雷过程高斯混合模型（DPGMM）分布来拟合由每个查询任务的支持集构建的负对的相似度得分，并创建一个新的开放集识别度量。第三，通过利用在粗粒度和细粒度级别上提取的特征，我们构建了分层交叉熵损失，以提高相似度得分的置信度。