标题： 面向漂移的自演化加密流量应用分类方法在实际网络环境中的应用 显示英文标题

标题： Drift-oriented Self-evolving Encrypted Traffic Application Classification for Actual Network Environment

摘要： 加密流量分类技术是网络管理和安全防护中的关键决策信息来源。 它具有响应及时性优秀、大规模数据承载和跨时空分析等优势。 现有的加密流量分类研究已逐渐从封闭世界转向开放世界，提出了许多分类器优化和特征工程方案。 然而，加密流量分类尚未能有效应用于实际网络环境。 主要原因在于互联网上的应用程序不断更新，包括功能调整和版本变化，这带来了严重的特征概念漂移，导致分类器迅速失效。 因此，整个模型必须在非常短的时间内重新训练，而带有标记样本的构建和模型训练成本是不可接受的。 为了解决这个问题，我们深入研究了互联网应用更新的特性，将其与特征概念漂移相关联，然后提出了自进化加密流量分类方法。 我们提出了一种特征概念漂移确定方法和一种基于Laida准则的面向漂移的自进化微调方法，以适应所有可能更新的应用。 在没有精确标记样本的情况下，分类器通过持续的完全微调进行进化，两次必要重新训练之间的时间间隔大大延长，从而可以应用于实际网络环境。 实验表明，我们的方法在后续月份的后续阶段数据集上显著提高了原始分类器的分类性能（F1分数提高了9%），而无需任何难以获取的标记样本。 在当前的实验环境下，分类器的寿命延长到了八个月以上。 显示英文摘要

摘要： Encrypted traffic classification technology is a crucial decision-making information source for network management and security protection. It has the advantages of excellent response timeliness, large-scale data bearing, and cross-time-and-space analysis. The existing research on encrypted traffic classification has gradually transitioned from the closed world to the open world, and many classifier optimization and feature engineering schemes have been proposed. However, encrypted traffic classification has yet to be effectively applied to the actual network environment. The main reason is that applications on the Internet are constantly updated, including function adjustment and version change, which brings severe feature concept drift, resulting in rapid failure of the classifier. Hence, the entire model must be retrained only past very fast time, with unacceptable labeled sample constructing and model training cost. To solve this problem, we deeply study the characteristics of Internet application updates, associate them with feature concept drift, and then propose self-evolving encrypted traffic classification. We propose a feature concept drift determination method and a drift-oriented self-evolving fine-tuning method based on the Laida criterion to adapt to all applications that are likely to be updated. In the case of no exact label samples, the classifier evolves through fully fine-tuning continuously, and the time interval between two necessary retraining is greatly extended to be applied to the actual network environment. Experiments show that our approach significantly improves the classification performance of the original classifier on the following stage dataset of the following months (9\% improvement on F1-score) without any hard-to-acquire labeled sample. Under the current experimental environment, the life of the classifier is extended to more than eight months.