Abstract:In the field of encrypted mobile application traffic classification, traditional methods classify traffic based on the characteristics of bidirectional traffic. However, in actual scenarios, asymmetric routing will cause remote network administrators to only obtain unidirectional traffic, which will reduce the accuracy of traditional methods. Therefore, an encrypted mobile application traffic classification method using only one-way traffic characteristics is designed. Since downlink traffic contains more information than uplink traffic, the payload of downlink traffic is chosen for analysis. Due to the temporal and spatial correlation of mobile application traffic, a bidirectional long short-term memory network is proposed to capture the temporal correlation of data streams, a convolutional neural network is used to learn the spatial correlation of features, and an attention layer is introduced to focus on important features to further improve the recognition accuracy. Compared with the previous methods, this method has a wider range of use, can be applied to both unidirectional and bidirectional traffic scenarios, and uses fewer features to obtain higher accuracy.