linwhitehat/ET-BERT

The repository of ET-BERT, a network traffic classification model on encrypted traffic. The work has been accepted as The Web Conference (WWW) 2022 accepted paper.

What it solves

ET-BERT addresses the challenge of classifying encrypted network traffic. Because the content of the traffic is encrypted, traditional deep learning models often struggle to identify the type of traffic or the application generating it. ET-BERT provides a way to learn the contextual relationships between datagrams to accurately identify traffic classes.

How it works

The project uses a Transformer-based architecture (similar to BERT) to represent encrypted traffic as a sequence of datagrams. It follows a two-step process:

  1. Pre-training: The model is trained on large-scale unlabeled encrypted traffic to learn general inter-datagram and transport relationships using multi-layer attention.
  2. Fine-tuning: The model is then fine-tuned on a small, labeled dataset for a specific traffic classification scenario to identify specific traffic types.

Who it’s for

This tool is designed for network security researchers and engineers who need to classify encrypted traffic for monitoring, security analysis, or network management.

Highlights

  • Contextual Representation: Learns the relationships between datagrams rather than looking at packets in isolation.
  • Pre-training Approach: Uses a large unlabeled corpus of traffic to build a foundational understanding before specializing.
  • Scalable: Can be applied to various encrypted traffic scenarios through fine-tuning.
  • Academic Grounding: Based on a peer-reviewed paper published at The Web Conference (WWW) 2022.

Related