0
$\begingroup$

I want to labelling network traffic (several .pcap-files) to different classifications. But this network traffic are not just one entry, there are sequence of entries (~50).

So how is it possible, to labelling the sequence of network traffic to one single label? To convert from .pcap-file to .csv I need tshark, where I also pick the needed properties from the .pcap-files.

I wish, that I can labelling a sequence of network traffic to example "internet activity 1" and another sequence to "internet activity 2".

Here are two screenshot from pcap files, where I want to labelling as whole and feed into a ML model

As example "internet activity1" enter image description here

And "internet activity2" enter image description here

And with this labeled datas, I want to train a machine learning algorithm. But all example in the internet are with one-labelling-approach (per row, one label). So nowhere I saw a classification, were based on multiple rows.

I am new to this topic and grateful for any help and advice

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Based on your comments and sample provided, I woud summary/rephrase your question as:

How to create a Machine Learning model to classify Network Traffic?

The samples you have provided, suggest in general at least two possible approaches, one similar to Text Classification and the other like any generic supervised learning example.

The samples show as a function of time, the various packets to and from a destination, which may not be the same length or duration (i.e. the number of captured packets could vary). Both approaches require an input (typically referred to as features) and an output (typically called a target).

The first step is to organise the data such that one file/entry/capture containing multiple packets maps to a single classification label. Network traffic captured using wireshark, or tcpdump or similar tools use line breaks to denote different packets. These can be difficult to process for most ML frameworks so in the first instance these can be removed or replaced with something else. An example output may look the following:

Input Output
1 0.000 192.168.0.5 192.168.0.2 HTTP 250 Get /HTTP/1.1 .... Social Media
1 0.000 192.168.0.5 192.168.0.2 HTTP 250 Get /HTTP/1.1 .... Streaming Video

Once data is in this format you can probably follow a Text Classification type approach 1. You need to be careful how these "words" are translated to the ML model itself. Most ML models can't read, so need to text to translated to numbers a process of vectorisation or tokenisation. You need to be careful of using some methods in Natural Language Processing (NLP) as they use existing models to map words to numbers. In your case, HTTP, TCP etc are not typically used in natural languages and may have no mapping 2.

I believe this answers your question.

However, as a Subject Matter Expert (SME) in network traffic, you may identify aspects in the data that you feel are important in classifying it. For example:

  • Does the actual source and destination IP influence the classification? If not, you might to replace it with perhaps a direction or replace the IP addresses with the text "src" and "dest" instead.
  • Does the sequence number matter?
  • Does how long something took to respond a factor?
  • If a HTTP Code is received, does that a have strong influence on the outcome?

If so, you could add them as extra columns e.g.

Traffic HTTP Code Output
1 0.000 192.168.0.5 192.168.0.2 HTTP 250 Get /HTTP/1.1 .... 200 Social Media
1 0.000 192.168.0.5 192.168.0.2 HTTP 250 Get /HTTP/1.1 .... 400 Streaming Video

The idea of manipulating the input data to help the model is called feature engineering.

Based on my experience, using raw network traffic is likely to cause most ML models problems, without some modification or feature extraction.

Improve this answer
$\endgroup$
9
  • $\begingroup$ Thanks for the reply! But is the first interpretation really “professional”, i.e. state of the art? Because packing the sequence of internet traffic into one single line results in an incredibly long line... And that would mean that the csv-file contains 2 columns; one with all the internet traffic and one with the respective label if I understood correctly. And what exactly do you mean by the approach that "to place each sequence in a column" in other considerations? $\endgroup$
    – user155518
    Commented Oct 23, 2023 at 18:54
  • $\begingroup$ ...and I would prefer your 2nd Interpretation, but I don't think you can use it to create a classification model... Because those 50 lines would all have the same label and would all have to "match" to make a classification about other internet traffic. $\endgroup$
    – user155518
    Commented Oct 23, 2023 at 18:59
  • $\begingroup$ What do you want your ML model to do? Does each sequence (contained within each pcap file) represent a different type of internet activity e.g. social media browsing, news, video streaming ? Or does each pcap file represent different type of internet activity? The approach I have highlighted isn't state of the art. $\endgroup$
    – fswings
    Commented Oct 23, 2023 at 21:19
  • $\begingroup$ Your second comment about "50 lines would all have the same label and would all have to "match" to make a classification about other internet traffic" does not seem correct to me. I can have 50 cat pictures, all slightly different but are still cats and therefore will have the same label: cats. $\endgroup$
    – fswings
    Commented Oct 23, 2023 at 21:20
  • $\begingroup$ Not every sequence in the pcap file represents a different type of internet, rather the whole pcap-file represent ONE internet activity (will have several similar activities, to train the model). And the ML model should recognize the sequence of such an activity as "match" or "not match". Your comparison with the cats does not fit with my approach. The approach would rather be that I have 10 pictures that contain only parts of a cat (head, ears, paw...) and only the 10 pictures make a whole cat. Only in this way can the cat/internet traffic be detected. Individual parts of it bring nothing. $\endgroup$
    – user155518
    Commented Oct 24, 2023 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.