Adversarial Defense and Detection Framework for Encrypted Network Traffic Classification

Abstract

The current CNN‐based encrypted traffic classifiers achieve high accuracy in normal situations, but are very susceptible to adversarial attacks resulting in significant reductions in classification accuracy. In addition, traditional defense methods such as adversarial training (AT) have been inconsistent across traffic types, causing model collapse in some domains and only providing partial defense with limited coverage of the attacks. Finally, when standalone defense methods are employed, for example, feature squeezing or denoising autoencoders, they provide only partial protection and do not cover all attacks. In this paper, we propose an adversarial defense and detection framework with a hybrid architecture to overcome these drawbacks. The first module is an autoencoder‐based restoration module to remove adversarially corrupted traffic inputs before classification. The second is a multisignal detection module which consists of eight indicators that include reconstruction error, LID, KL divergence, prediction uncertainty, physical plausibility, and activation pattern to identify and flag adversarial samples. The framework's average true‐positive detection rate is 85% and its restoration accuracy is 84.30%, revealing that a combined approach is required to effectively defend encrypted traffic classifiers against sophisticated adversarial attacks. Two standard benchmark datasets, CIC‐Darknet2020 (95.36% accuracy with baseline CNN) and CIC‐IDS2017 (90.95% accuracy with baseline CNN), are used to evaluate the proposed framework, and the accuracy of the baseline CNN drops to 8.56% and 34.43%, respectively, when the adversarial attacks are applied prior to the defense.