Abstract:In the field of encrypted mobile application traffic classification, traditional methods classify traffic based on the characteristics of bidirectional traffic. However, in actual scenarios, asymmetric routing will cause remote monitors to only obtain unidirectional traffic, which will reduce the accuracy of traditional methods. Therefore, this paper designs an encrypted mobile application traffic classification method using only one-way traffic characteristics. Since downlink traffic contains more information than uplink traffic, this paper chooses to analyze the payload of downlink traffic. Due to the temporal and spatial correlation of mobile application traffic, a bidirectional long short-term memory network is proposed to capture the temporal correlation of data streams, a convolutional neural network is used to learn the spatial correlation of features, and an attention layer is introduced to focus on important features to further improve the recognition accuracy. Compared with the previous methods, this method has a wider range of use, can be applied to both unidirectional and bidirectional traffic scenarios, and uses fewer features to obtain higher accuracy.