# Deep Learning-Based Efficient Analysis for Encrypted Traffic
## 3 System Framework of Encrypted Traffic Identification
### Data Padding and Truncation for Encrypted Traffic
Moving on to the deep learning model, we analyze the structure and principle of the existing model, gradually building the detection model. Finally, we utilize softmax as the last layer classifier for traffic identification, completing the construction of the entire encrypted traffic identification system. We perform statistical analysis on different traffic types in the ISCXVPN2016 dataset. Consider the Email type, which corresponds to four PCAP files. We first sum up the file sizes to count the quantity of data we need to process and provide a reference for later preprocessing work. We count all available packets by filtering them according to the traffic-cleaning steps described in Section 3. Figure 5 shows the traffic statistics for all 12 types. The one-dimensional CNN model used in this paper contains two convolutional layers, one maximum pooling layer, and five fully connected layers. ReLU is added to the two convolutional layers and five fully connected layers as a nonlinear activation function, and the specific hyperparameters are shown in Table 2.

On the basis of CNN, the LSTM model is further added to extract the temporal features of the feature vector sequence. The CNN and LSTM (C-LSTM) model employed in this study shares similarities with the aforementioned CNN, comprising two convolutional layers and a max-pooling layer. Then, we utilize the output of the max-pooling layer as the input for the subsequent LSTM layer, which has a hidden layer size of 50. The resulting output is flattened and fed into a 3-layer fully connected network for fitting, with the hyperparameters detailed in Table 3.

Figure 4: One-dimensional CNN model structure diagram. First, we evaluated the 1D CNN model constructed and trained in this paper, which achieves 94.6 percent accuracy and can efficiently identify TLS and VPN-encrypted traffic. The accuracy rates are depicted in Figure 6, whereas the recall rates are portrayed in Figure 7.

In the context of precision and recall, the one-dimensional CNN model developed in this paper outperforms traditional machine learning algorithms, such as the C4.5 algorithm and the KNN algorithm, both of which rely on manually selected data features. The model constructed in this paper is compared with other methods for traffic identification based on the ISCXVPN2016 dataset. The precision and recall rates of each model are shown in Figure 8. \begin{table}
\begin{tabular}{c c c c c c} \hline
**Layer** & **Operation** & **Kernel Size** & **Step-Size** & **Input Size** & **Output Size** \\ \hline
1 & Conv1d + ReLU & 5 & 3 & \(1\times 1480\) & \(50\times 492\) \\
2 & Conv1d + ReLU & 4 & 3 & \(50\times 492\) & \(50\times 163\) \\
3 & MaxPool1d & 2 & 2 & \(50\times 163\) & \(50\times 81\) \\
4 & Linear + Dropout + ReLU & - & - & \(1\times 4050\) & \(1\times 400\) \\
5 & Linear + Dropout + ReLU & - & - & \(1\times 400\) & \(1\times 200\) \\
6 & Linear + Dropout + ReLU & - & - & \(1\times 200\) & \(1\times 100\) \\
7 & Linear + Dropout + ReLU & - & - & \(1\times 100\) & \(1\times 50\) \\
8 & Linear & - & - & \(1\times 50\) & \(1\times 12\) \\ \hline \end{tabular}
\end{table} 
Table 2: Temperature and wildlife count in the three areas covered by the study. Figure 5: Dataset Statistics. Figure 8: Accuracy and recall rate comparison of models. Figure 6: Accuracy rate of the one-dimensional CNN model on various traffic flow types. Figure 7: Recall rate of the one-dimensional CNN model on various traffic flow types. The one-dimensional CNN-based encrypted traffic identification model effectively detects TLS and VPN encrypted traffic. We compared the predicted labels with the true labels obtained from the test set packets and the resulting matrix is shown in Figure 9. Each row represents the actual traffic type, while each column represents the predicted traffic type based on the one-dimensional CNN model. It is evident that the model demonstrates excellent performance across most traffic types.