TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT

In the Industrial Internet of Things (IIoT) in the 5G era, the growth of smart devices will generate a large amount of data traffic, bringing a huge challenge of network traffic classification, which is the prerequisite of IIoT traffic engineering, quality of service (QoS), cyberspace security, etc. It is difficult for current traffic classification methods to distinguish encrypted dataflow and design effective handcraft features. In this paper, a novel identification scheme of encrypted traffic, TSCRNN, is proposed to automatically extract features for efficient traffic classification, which is based on spatiotemporal features. TSCRNN includes the preprocessing phase and the classification phase. In the preprocessing phase, raw traffic data are processed with flow segmentation, sampling, and vectorization, etc. To solve the classification problem of long time flow, sampling strategies are used to collect samples from the middle of the long-lived flow. In the classification phase, TSCRNN extracts abstract spatial features by CNN and then introduces stack bidirectional LSTM to learn the temporal characteristics. The experiments were performed on the dataset ISCXTor2016. The experimental results show that TSCRNN outperforms other typical methods in all scenarios, which achieves the accuracy up to 99.4% and 95.0% respectively in Tor/nonTor binary classification tasks and sixteen classification tasks. Furthermore, TSCRNN is applied to other real network datasets obtained the satisfactory performance, which validates its feasibility and universality. It means that TSCRNN can effectively identify encrypted and anonymous traffic, provide a fine-grained traffic characterization mechanism, which will support the development of core technologies in the Industrial Internet of Things.