MTT: an efficient model for encrypted network traffic classification using multi-task transformer

Network traffic classification aims to associate the network traffic with a class of traffic characterization (e.g., Streaming) or applications (e.g., Facebook). This ability plays an important role in advanced network management. The tasks of traffic characterization and application identification are usually implemented by individual models. However, when multiple models are deployed in the online environment, this causes a dramatic increase in the complexity, resource demand and maintenance costs. In this paper, an efficient multi-task learning method named multi-task transformer (MTT) is proposed. It simultaneously classifies the traffic characterization and application identification tasks. The proposed model considers the input packet as a sequence of bytes and applies a multi-head attention mechanism to extract features. Experiments are conducted on the ISCX VPN-nonVPN dataset to demonstrate the effectiveness of MTT. \(F_1\) scores of 98.75% and 99.35% have been achieved for application identification and traffic characterization, respectively. To the best of our knowledge, the results are better than the state-of-the-art results. The MTT model outputs the two results simultaneously in \(\sim\) 0.1 milliseconds (per packet), which satisfies the requirement of online traffic classification. Compared with the 1D-CNN and 2D-CNN models, the proposed MTT model is more stable, presents higher classification performance and requires less storage space. Finally, the selection strategies of input length for different neural networks are suggested and the related principles are investigated.