Let model keep evolving: Incremental learning for encrypted traffic classification

Encrypted Traffic Classification (ETC) is valuable for many network management and security solutions as it provides insights into applications active on the network. However, the network environment constantly evolves, and new applications emerge in an endless stream daily, which gradually makes well-trained ETC models ineffective. The conventional approach to adapting new applications is to re-train the models on a re-formed dataset with both pre-existing and new application samples. The major limitation is that requiring redundant computing resources and sufficient storage spaces. In this work, we propose an Incremental Learning (IL) framework based on multi-view sequences fusion, MISS, to keep ETC models evolving with new applications. The key novelty of MISS is three-fold: extract cross-view information from multi-view sequences to capture sufficient knowledge; propose an exemplar selection algorithm from communication patterns to reduce redundant consumption; design a pair of branches from the learnability of parameters to mitigate accuracy loss during evolution. MISS outperforms the existing IL methods of ETC, and the state-of-the-art ETC models using the classic IL framework, on the real-world network traffic datasets, which achieves satisfactory improvements of 11.37%↑ and 1.58%↑. Furthermore, we comprehensively perform incremental experiments to evaluate the evolution ability of MISS, which is able to select representative exemplars of old applications, counteract the adverse effects of homogeneous applications, and keep evolving with unknown applications.