Deep-Learning-Based Uncertainty-Estimation Approach for Unknown Traffic Identification

Real open network environments include the traffic generated by known applications or protocols, which have been previously identified and labeled, and unknown network traffic that cannot be identified based on existing knowledge. Accurately identifying unknown traffic is critical to network management and security, not only to help managers allocate bandwidth appropriately for all types of applications and ensure quality of service, but also to prevent security breaches that may result from unknown applications or protocols. Notably, the unknown network traffic has been increasing with the emergence of new applications or protocols, which further increases the difficulty in identifying them. Existing unknown traffic classification methods based on Softmax output confidence values cause bias in the prediction probability due to overconfidence of the model during the training process, thus decreasing the identification accuracy. Thus, for unknown traffic identification, this study proposes a deep-learning-based uncertainty-estimation (EUE) approach. EUE introduces the theory of evidence to the task of identifying unknown traffic by inferring traffic uncertainty directly from traffic evidence without the need for a Softmax layer, thus avoiding overconfidence in the model. Thus, the EUE can accurately identify unknown traffic while classifying known traffic at the application level. We construct two experimental scenarios simulating the real network environments with different proportions of unknown traffic to evaluate EUE. The experimental results show that the proposed approach EUE exhibits excellent classification accuracy.