Hybrid Deep Neural Network - Hidden Markov Model Based Network Traffic Classification

  • Xincheng Tan
  • Yi XieEmail author
Conference paper
Part of the Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering book series (LNICST, volume 262)


Traffic classification has been well studied in the past two decades, due to its importance for network management and security defense. However, most of existing work in this area only focuses on protocol identification of network traffic instead of content classification. In this paper, we present a new scheme to distinguish the content type for network traffic. The proposed scheme is based on two simple network-layer features that include relative packet arrival time and packet size. We utilize a new model that combines deep neural network and hidden Markov model to describe the network traffic behavior generated by a given content type. For a given model, deep neural network calculates the posterior probabilities of each hidden state based on given traffic feature sequence; while the hidden Markov model profiles the time-varying dynamic process of the traffic features. We derive the parameter learning algorithm for the proposed model and conduct experiments by using real-world network traffic. Our results show that the proposed approach is able to improve the accuracy of conventional GMM-HMM from 77.66% to 96.11%.


Network traffic Content classification Hidden Markov model Deep neural network 


  1. 1.
    Alberto, D., Antonio, P., Pierluigi, S., et al.: An hmm approach to internet traffic modeling. In: proceeding of IEEE GLOBECOM (2006)Google Scholar
  2. 2.
    Chen, Z., He, K., Li, J., Geng, Y.: Seq2img: A sequence-to-image based approach towards ip traffic classification using convolutional neural networks. 2017 IEEE International Conference on Big Data (Big Data), pp. 1271–1276. IEEE (2017).
  3. 3.
    Dainotti, A., De Donato, W., Pescape, A., Rossi, P.S.: Classification of network traffic via packet-level hidden markov models. In: Global Telecommunications Conference, 2008. IEEE GLOBECOM 2008. IEEE. pp. 1–5. IEEE (2008).
  4. 4.
    Finsterbusch, M., Richter, C., Rocha, E., Muller, J.A., Hanssgen, K.: A survey of payload-based traffic classification approaches. IEEE Commun. Surv. Tutor. 16(2), 1135–1156 (2014). Scholar
  5. 5.
    LeCun, Y., Bengio, Y., Hinton, G.: Deep learning. Nature 521(7553), 436 (2015). Scholar
  6. 6.
    Li, W., Moore, A.W., Canini, M.: Classifying http traffic in the new age. In: ACM SIGCOMM 2008 Conference (2008)Google Scholar
  7. 7.
    Madhukar, A., Williamson, C.: A longitudinal study of p2p traffic classification. In: IEEE International Symposium on Modeling, Analysis, and Simulation. pp. 179–188 (2006).
  8. 8.
    Mu, X., Wu, W.: A parallelized network traffic classification based on hidden markov model. In: 2011 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), pp. 107–112. IEEE (2011)Google Scholar
  9. 9.
    Nguyen, T.T.T., Armitage, G.: A survey of techniques for internet traffic classification using machine learning. IEEE Press (2008)Google Scholar
  10. 10.
    Perera, P., Tian, Y.C., Fidge, C., Kelly, W.: A comparison of supervised machine learning algorithms for classification of communications network traffic. In: International Conference on Neural Information Processing, pp. 445–454. Springer, Berlin (2017). Scholar
  11. 11.
    Rabiner, L.R.: A tutorial on hidden markov models and selected applications in speech recognition. Proc. IEEE 77(2), 257–286 (1989). Scholar
  12. 12.
    Thang, T.C., Le, H.T., Nguyen, H.X., Pham, A.T., Kang, J.W., Ro, Y.M.: Adaptive video streaming over http with dynamic resource estimation. J. Commun. Netw. 15(6), 635–644 (2013)CrossRefGoogle Scholar
  13. 13.
    Wang, W., Zhu, M., Wang, J., Zeng, X., Yang, Z.: End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In: 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 43–48. IEEE (2017).
  14. 14.
    Wang, Z.: The applications of deep learning on traffic identification. BlackHat USA (2015)Google Scholar
  15. 15.
    Wright, C., Monrose, F., Masson, G.M.: Hmm profiles for network traffic classification. In: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security. pp. 9–15. ACM (2004).
  16. 16.
    Yu, D., Deng, L.: Deep neural network-hidden markov model hybrid systems. In: Automatic Speech Recognition, pp. 99–116. Springer, Berlin (2015). Scholar

Copyright information

© ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2019

Authors and Affiliations

  1. 1.School of Data and Computer ScienceSun Yat-sen UniversityGuangzhouChina

Personalised recommendations