# Deep Learning-Based Efficient Analysis for Encrypted Traffic
## 3 System Framework of Encrypted Traffic Identification
### Data Padding and Truncation for Encrypted Traffic  
The protocols at the transport layer include TCP and UDP protocols. The length of the header is 20 bytes and 8 bytes, respectively. The payload starts from the 21 st and 9 th bytes of the packet. The corresponding input vectors of the same part cannot be aligned in dimensionality, which affects the recognition effect of the model for different protocols. Therefore, to align the dimensions of the feature vectors corresponding to the application layer loads of the two protocols so that the convolutional neural network can extract the correct spatial features, the UDP header fields can be processed with zero padding, as shown in Figure 3. As shown, 12 bytes of all-zero data are filled after the header field of the UDP data packet so that the sum of the header length of the original data packet and the zero-filled content is 20 bytes, which is the same length as the header field of the TCP protocol. The maximum length of an IP datagram should be 1500 bytes. After removing the network layer header in the traffic anonymization step, the packet length will decrease by 20 bytes, so the total length of the packet should be 1480 bytes for only the transport layer and all layers above it. Finally, in implementing the padding and truncation steps, the data packets are padded with insufficient length and the data packets that are too long are truncated so that the length of all data packets is 1480 bytes. The pseudocode is shown in Algorithm 3. ```
Input:Packet Object, packet Output:PADDING Packet Object, packet
```
1 functionPADDING-AND-TRUNCATION(packet) ifpacket.protocol = UDP then
3 packet+-packet.head/0x00 * 12/packet.payload
4 ifpacket.length < 1480 then
5 packet+-packet/0x00 * (1480 \(-\) packet.length)
6 elseifpacket.length > 1480 then
7 packet+-packet[1:1480]
8 returnpacket
```

**Algorithm 3**Data Padding and Truncation Algorithms

### Anonymization of Encrypted Traffic

Normalization makes the input vector conform to the deep learning framework standard and speeds up the optimization process of neural network training. As is known, a byte has 8 bits that can represent 256 values (0 to 255). The input vector should be normalized. Package \(P\) can be thought of as a byte array of length \(n\) of 1480: \((p_{1},p_{2},\ldots,p_{n})\). We convert the data to a float, as a float is more suitable for CPU or GPU calculations. Through normalization, the range of feature values of different dimensions is adjusted to a similar range, and a large learning rate can be uniformly used to accelerate learning. The value range of element \(p_{i}\) is \(\left[0,2^{8}\right)\). When we divide the data by 255, we obtain a value in the range of 0 to 1. We express the normalization operation as the following formula. \[x_{i}=\frac{p_{i}}{p_{max}-p_{min}}=\frac{p_{i}}{255} \tag{1}\]

The normalized vector \(X=x_{1},x_{2},\ldots,x_{n}\in\left[0,1\right]^{n}\) is obtained, and the pseudocode of the normalization step is shown in Algorithm 4. Figure 3: The framework of the encrypted traffic identification system based on CNN. ```
Input:Packet object, packet Output: NormalizedPacket Object, packet
```

**Algorithm 4**Traffic Normalization Algorithm

After preprocessing all the packets in the dataset, we obtain an array of input vectors suitable for the deep learning framework. Next, we construct a suitable deep learning model to complete traffic feature extraction. The algorithm reads each PCAP file in the dataset online. Additionally, the packets are read into memory individually, and the protocol of each layer is parsed. Normalization conforms the input vectors to the standard of deep learning frameworks and speeds up the optimization process of neural network training. The input vector should be normalized. ### Split Training Sets, Validation Sets, and Test Sets

To mitigate the issues of overfitting and underfitting during the training process, we partition the data into three subsets: training set, validation set, and test set.