# Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

arXiv: https://arxiv.org/abs/1709.02656 · HTML: https://mlsanity.com/paper/1709.02656/

## Key facts

- Cited by 70 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Sep 2017.

## Built on by (most cited first, 30 of 70)

- [ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification](https://mlsanity.com/paper/2202.06335/) (2022)
- [NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba](https://mlsanity.com/paper/2405.11449/) (2024)
- [Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications](https://mlsanity.com/paper/2104.03182/) (2021)
- [TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification](https://mlsanity.com/paper/2307.16713/) (2023)
- [Communication-Efficient Large-Scale Distributed Deep Learning: A Comprehensive Survey](https://mlsanity.com/paper/2404.06114/) (2024)
- [Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification](https://mlsanity.com/paper/2205.05628/) (2022)
- [Lens: A Knowledge-Guided Foundation Model for Network Traffic](https://mlsanity.com/paper/2402.03646/) (2024)
- [CGNN: Traffic Classification with Graph Neural Network](https://mlsanity.com/paper/2110.09726/) (2021)
- [A Lightweight, Efficient and Explainable-by-Design Convolutional Neural Network for Internet Traffic Classification](https://mlsanity.com/paper/2202.05535/) (2022)
- [Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study](https://mlsanity.com/paper/2203.09332/) (2022)
- [Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation](https://mlsanity.com/paper/2305.11039/) (2023)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Evaluating Resilience of Encrypted Traffic Classification Against Adversarial Evasion Attacks](https://mlsanity.com/paper/2105.14564/) (2021)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [A First Look at Class Incremental Learning in Deep Learning Mobile Traffic Classification](https://mlsanity.com/paper/2107.04464/) (2021)
- [Explainable Artificial Intelligence for Smart City Application: A Secure and Trusted Platform](https://mlsanity.com/paper/2111.00601/) (2021)
- [A Transformer-Based Framework for Payload Malware Detection and Classification](https://mlsanity.com/paper/2403.18223/) (2024)
- [Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach](https://mlsanity.com/paper/2409.11254/) (2024)
- [Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification](https://mlsanity.com/paper/2505.20866/) (2025)
- [Energy-Efficient Deep Learning for Traffic Classification on Microcontrollers](https://mlsanity.com/paper/2506.10851/) (2025)
- [ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection](https://mlsanity.com/paper/2205.01432/) (2022)
- [Visualization Of Class Activation Maps To Explain AI Classification Of Network Packet Captures](https://mlsanity.com/paper/2209.02045/) (2022)
- [Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows](https://mlsanity.com/paper/2403.10550/) (2024)
- [Hardware-Aware Neural Architecture Search for Encrypted Traffic Classification on Resource-Constrained Devices](https://mlsanity.com/paper/2506.11319/) (2025)
- [FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification](https://mlsanity.com/paper/2508.19924/) (2025)
- [Multi-view Multi-label Anomaly Network Traffic Classification based on MLP-Mixer Neural Network](https://mlsanity.com/paper/2210.16719/) (2022)
- [Towards the Visualization of Aggregated Class Activation Maps to Analyse the Global Contribution of Class Features](https://mlsanity.com/paper/2308.00710/) (2023)
- [AutoML4ETC: Automated Neural Architecture Search for Real-World Encrypted Traffic Classification](https://mlsanity.com/paper/2308.02182/) (2023)
- [Enhancing IoT Security via Automatic Network Traffic Analysis: The Transition from Machine Learning to Deep Learning](https://mlsanity.com/paper/2312.00034/) (2023)
- [Resource Allocation and Workload Scheduling for Large-Scale Distributed Deep Learning: A Survey](https://mlsanity.com/paper/2406.08115/) (2024)

## Abstract (arXiv)

Internet traffic classification has become more important with rapid growth of current Internet network and online applications. There have been numerous studies on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a deep learning based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both traffic characterization in which the network traffic is categorized into major classes (eg, FTP and P2P) and application identification in which end-user applications (eg, BitTorrent and Skype) identification is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non-VPN network traffic. After an initial pre-processing phase on data, packets are fed into Deep Packet framework that embeds stacked autoencoder and convolution neural network in order to classify network traffic. Deep packet with CNN as its classification model achieved recall of 0.98 in application identification task and 0.94 in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN-nonVPN dataset.