IncreAIBMF: Incremental Learning for Encrypted Mobile Application Identification

Mobile application identification, as the fundamental technique in the field of network security and management, suffers from a critical problem, namely ‘encrypted traffic’. The proven methods for encrypted traffic identification have a major drawback, which is new come applications continue to suffer from catastrophic forgetting, a dramatic decrease in overall performance when training with new app classes added incrementally. This is due to the current model requiring the entire dataset, consisting of all the samples from the old and the new classes, to update the model. The updating requirement becomes easily unsustainable as the number of apps grows, To address the issue, we propose IncreAIBMF framework to learn deep neural networks incrementally, using new apps data and only a small exemplar set corresponding to samples from the old apps. The key idea behind IncreAIBMF is an incremental learning framework which possesses new application identification ability by incorporating the cross-distilled loss, which can not only learn the new app classes and also retain the previous knowledge corresponding to the old app classes. Our experiment results show that IncreAIBMF achieves 87.3% on Macro Precision, 87.8% on F1 Score and 88.9% on Macro Recall, respectively, on the real-world traces that consists of 50 mobile applications, supports the early prediction, and is robust to the scale of the app classes. Besides, the basic variant of IncreAIBMF, AIBMF is superior to the state-of-the-art methods in terms of identification performance.