Drift-oriented Self-evolving Encrypted Traffic Application Classification for Actual Network Environment

2025-01-08

AI Summary

Concept drift caused by frequent updates of network applications severely degrades the performance of encrypted traffic classifiers, necessitating costly retraining with large volumes of newly labeled data and resulting in short model lifespans. Method: This paper proposes a self-evolving classification framework that operates without additional annotations. It employs the Laida criterion for fine-grained drift detection and introduces a drift-guided, full-parameter continual fine-tuning mechanism, integrated with unsupervised concept adaptation and dynamic feature evolution modeling. Contribution/Results: To our knowledge, this is the first approach to extend classifier effective lifetime beyond eight months under zero new annotation constraints. Evaluated on monthly test sets, it achieves an average 9% improvement in F1-score over baseline methods, substantially reducing retraining frequency and operational overhead. The framework establishes a novel paradigm for long-term, stable encrypted traffic identification in real-world deployments.

Technology Category

• Machine Learning: Life-Long and Continual Learning
• Search and Optimization: Evolutionary Computation
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Web Mining and Content Analysis: Models for Web evolution
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Encrypted traffic classification technology is a crucial decision-making information source for network management and security protection. It has the advantages of excellent response timeliness, large-scale data bearing, and cross-time-and-space analysis. The existing research on encrypted traffic classification has gradually transitioned from the closed world to the open world, and many classifier optimization and feature engineering schemes have been proposed. However, encrypted traffic classification has yet to be effectively applied to the actual network environment. The main reason is that applications on the Internet are constantly updated, including function adjustment and version change, which brings severe feature concept drift, resulting in rapid failure of the classifier. Hence, the entire model must be retrained only past very fast time, with unacceptable labeled sample constructing and model training cost. To solve this problem, we deeply study the characteristics of Internet application updates, associate them with feature concept drift, and then propose self-evolving encrypted traffic classification. We propose a feature concept drift determination method and a drift-oriented self-evolving fine-tuning method based on the Laida criterion to adapt to all applications that are likely to be updated. In the case of no exact label samples, the classifier evolves through fully fine-tuning continuously, and the time interval between two necessary retraining is greatly extended to be applied to the actual network environment. Experiments show that our approach significantly improves the classification performance of the original classifier on the following stage dataset of the following months (9% improvement on F1-score) without any hard-to-acquire labeled sample. Under the current experimental environment, the life of the classifier is extended to more than eight months.

Problem

• Network Environment
• Encrypted Traffic Classification
• Adaptive Model

Innovation

• Adaptive Traffic Classification
• Laida Criterion
• Self-adjusting Learning