A Glimpse of the Whole: Path Optimization Prototypical Network for Few-Shot Encrypted Traffic Classification

With the prosperous application of encryption technology in network traffic, monitoring and analyzing network traffic efficiently become more and more challenging. Existing traffic classification methods mostly rely on sufficient and balanced training data, which inevitably require overwhelming labeling effort. Therefore, it is necessary to investigate an effective solution to relieve the enormous burden on annotating network data. To address the above issues, in this paper, we model the encrypted traffic classification as few-shot learning based on metric-learning and propose Path Optimization Prototypical Network (POPNet). Firstly, POPNet utilizes embedding model to map network traffic into a high dimensional metric space. Secondly, the distance between the embedded samples is optimized to aggregate samples with same category while estranging the distinct ones. Moreover, path optimization strategies are carefully designed to compress the searching space to obtain an efficient solution. Experimental results on regenerated datasets of real-world network traffic have demonstrated the effectiveness of our proposed POPNet. It is encouraging to see that, with barely a few training samples, POPNet has achieved superior performance on encrypted network traffic classification among the state-of-the-arts, and its performance is immune to the deduction of training samples.