When Deep Learning May Not Be The Right Tool For Traffic Classification

Abstract

Traffic Classification System (TCS) allows inferring the application that is generating given network traffic. Other systems can use this information to enforce specific network policies on the analyzed traffic. In recent years, Traffic Classifier (TC) based on Deep Learning (DL) have outperformed traditional methods such as port-based and statistical Machine Learning (ML). Although these TC can achieve high accuracy on raw data, most of those works do not provide any reasoning or interpretation about how the trained model could achieve such performance. This lack of interpretability may lead to unpredicted behaviour of the systems that consume such information. To understand what the DL models are learning, we conduct a set of experiments reveal what the DL models are learning and we validate our reasoning by building and training simpler ML models that use the revealed features and could even outperform the DL models in some evaluations.