Abstract: To address the problems of low accuracy of traditional encrypted traffic classification methods,the use of traffic load will violate user privacy and weak generalization ability,an encrypted traffic classification method of CNN and BiGRU based on self-attention(CNN-AttBiGRU) is proposed,which can be applied to both regular encrypted and VPN and Tor encrypted traffic.The method converts traffic into intuitive pictures based on packet size,packet arrival time and packet arrival direction.To improve the accuracy of the model,CNN is used to extract the spatial features of traffic pictures,while BiGRU and self-attention models are designed to extract temporal features,making full use of the temporal and spatial features of traffic pictures.The traffic can be classified at different levels by traffic category,encryption technique and application type.The proposed method achieves an average accuracy of 95.2% for classification of encrypted traffic categories,which is 11.65% better than before;95.5% for classification of encryption technologies,which is 7.1% better than before;and 99.8% for classification of applications used by traffic,which is 11.03% better than before.Experimental results show that the CNN-AttBiGRU method has strong ge-neralization ability and only utilizes some statistical features of encrypted traffic,which effectively protects user privacy while achieving high accuracy rates.

Key words: Encrypted traffic classification, Deep learning, CNN, BiGRU, Self-attention