Abstract:
With the widespread deployment of encrypted communication protocols, traditional traffic detection methods based on feature matching are becoming increasingly ineffective in complex network environments, struggling to cope with challenges posed by data distribution shifts and covert communication patterns. To address this issue, this paper proposes an encrypted traffic detection framework based on the transmission control protocol (TCP) with adaptive data augmentation strategies and dual-channel feature extraction to improve the robustness and generalization of the model in dynamic environments. Firstly, three TCP-based adaptive augmentation methods (TAAM) are designed to simulate network transmission behaviors such as timeout retransmissions, packet shifts, and MSS splits, generating diverse training samples and alleviating the problem of inconsistent training and test distributions. Secondly, a TSC-Net model is constructed, combining a long short-term memory (LSTM) network to extract communication temporal features with ashort-time Fourier transform (STFT) and convolutional neural network (CNN) to extract frequency domain features. This model achieves multidimensional modeling of potential pattern perturbations and periodicity in traffic. Experimental results on public encrypted traffic datasets and real-world network environments demonstrate that the proposed method outperforms existing mainstream models in terms of accuracy, robustness, and environmental adaptability. Specifically, the proposed method achieves 7.71% and 12.84% points higher classification accuracy than the best comparable method, respectively. Furthermore, ablation studies further validate the positive contributions of each module to the overall system performance.