Improving Network Traffic Classification Through Hierarchical LSTM and Temporal Feature Learning

Abstract

Network traffic classification is critical for efficient network management, security, and resource allocation. Previous studies mainly focus on non-hierarchical classification, treating network applications as isolated categories without considering their natural hierarchical relationships. This study presents a hierarchical classification methodology based on a Long-Short-Term Memory (LSTM) deep learning model to classify network applications at multiple granularity levels. Raw traffic data from the ISCX dataset is preprocessed to extract features based on a one-second observation time. The time series, encompassing 166 aggregated attributes, is derived from raw packet features and statistical summaries. A sliding window approach is implemented to capture temporal dependencies with input configurations of one-time step (1 T-LSTM) and three-time steps (3T-LSTM). Additionally, knowledge distillation techniques are applied to enhance classification accuracy further, yielding significant performance gains in applications such as ICQ and Netflix. The results demonstrate that the 3T-LSTM model consistently outperforms the IT-LSTM across all classification levels and achieves significant recall and Fl score improvements, particularly for chat and streaming applications. These findings highlight the effectiveness of hierarchical classification and temporal modeling in network traffic analysis.