On Learning Hierarchical Embeddings from Encrypted Network Traffic

This work presents a novel concept for learning embeddings from encrypted network traffic. In contrast to existing approaches, we evaluate the feasibility of hierarchical embeddings by iteratively aggregating packet embeddings to flow embeddings, and flow embeddings to trace embeddings. The hierarchical embedding concept was designed to especially consider complex dependencies of Internet traffic on different time scales. We describe this novel embedding concept for the domain of network traffic in full detail, and evaluate its performance for the downstream task of website fingerprinting, i.e., identifying websites from encrypted traffic, which is relevant for network management, e.g., as a prerequisite for QoE monitoring or for intrusion detection. Our evaluation reveals that embeddings are a promising solution for website fingerprinting as our model correctly labels up to 99.8% of traces from 500 target websites.

Automated summary

This work introduces a new concept for learning embeddings from encrypted network traffic, which evaluates hierarchical embeddings by aggregating packet embeddings to flow embeddings and flow embeddings to trace embeddings, considering the complex dependencies of Internet traffic. The evaluation shows promising results for website fingerprinting.