평균 기반 플로우스펙트럼 보정 기법을 활용한 암호화 트래픽 분류 모델 개선

다국어 초록 (Multilingual Abstract)

The rapid adoption of Transport Layer Security (TLS) 1.3 and emerging encrypted protocols such as QUIC has dramatically increased the proportion of encrypted network traffic, making traditional Deep Packet Inspection (DPI) techniques infeasible. As a result, classification approaches relying on non-payload information—particularly header-level statistical features and flow-level dynamics—have become essential. FlowSpectrum (FS), which transforms flow characteristics into a compact visual-quantitative representation, has shown competitive performance in encrypted traffic classification tasks.
However, the original FS formulation exhibits structural instability and high sensitivity to variance in packet sequences, primarily due to flow-level randomness and protocol-induced variability. These factors often cause overlapping spectral patterns between classes and lead to unstable similarity calculations, ultimately degrading the performance of downstream deep learning models.
To address these limitations, this study proposes the Mean FlowSpectrum (Mean FS) technique, an average-based correction method that integrates a mean-derived adjustment term into the similarity computation. By reflecting the central tendency of each class spectrum, the proposed correction stabilizes the global flow distribution and alleviates the effects of noisy or isolated spectral values. We incorporate the Mean FS representation into Semi-AE and Semi-2DCAE architectures for encrypted traffic classification.
Experimental evaluations on three datasets—ISCX-VPN2016, USTC-TFC2016, and a real-world TLS 1.3/SSH dataset—demonstrate that the Mean FS-enhanced models significantly outperform conventional FS in terms of Accuracy and F1-score. Notably, in practical environments such as our TLS 1.3/SSH dataset, Mean FS achieved superior performance even compared to YaTC, a state-of-the-art self-supervised representation-learning model. These results confirm that the proposed Mean FS technique effectively resolves structural weaknesses in FlowSpectrum and provides a more robust foundation for encrypted traffic classification in modern network environments.

목차 (Table of Contents)

• 1. 서론 12
• 2. 배경지식 및 관련 연구 15
• 2.1 암호화 트래픽 환경과 특징 15
• 2.2 전통적 트래픽 분류 기법 17
• 2.3 머신러닝 기반 트래픽 분류 기법 19
• 2.4 딥러닝 기반 트래픽 분류 기법 21
• 2.5 플로우스펙트럼 기반 트래픽 분류 기법 23
• 2.6 데이터 전처리와 특징 선택 26
• 3. 평균 기반 플로우스펙트럼 보정 기법 28
• 3.1 기존 플로우스펙트럼 기법의 한계 29
• 3.2 평균 기반 플로우스펙트럼 보정 기법 31
• 3.3 전처리 및 입력 크기 축소 34
• 3.3.1 SII 제거 34
• 3.3.2 12-tuple 헤더 기반 통계 특징 35
• 3.3.3 입력 크기 축소 37
• 4. 실험 및 성능 평가 39
• 4.1 실험 환경 39
• 4.2 실험 결과 및 분석 42
• 4.2.1 SII 제거에 따른 성능 분석 42
• 4.2.2 보정계수  변화에 따른 성능 분석 45
• 4.2.3 입력 크기 축소에 따른 성능 및 자원 사용 분석 47
• 4.2.4 기존 모델과의 성능 비교 49
• 5. 결론 58
• 참고문헌 60
• 영문요약 65