Network traffic classification is an important part of network monitoring and network management. Three traditional methods for network traffic classification are flow-based, session-based, and packet-based, while flow-based and session-based methods cannot meet the real-time requirements and existing packet-based methods will violate user's privacy. To solve the above problems, we propose a network traffic classification method only by the IP packet header, which satisfies the requirements of both the user's privacy protection and online classification performances. Through statistical analyses, we find that IP packet header information is effective on the network traffic classification tasks and this conclusion is also demonstrated by experiments. Furthermore, we propose a novel external attention and convolution mixed (ECM) model for online network traffic classification. This model adopts both low-computational complexity external attention and convolution to respectively extract the byte-level and packet-level characteristics for traffic classification. Therefore, it can achieve high classification accuracy and low time consumption. The experiments show that ECM can achieve the highest classification accuracy and the lowest delay, compared with other state-of-art models. The accuracy can respectively achieve 98.39% and 95.57% on two datasets and the classification time is shorten to meet the real-time requirements.

翻译：网络流量分类是网络监控与网络管理的重要组成部分。三种传统的网络流量分类方法分别为基于流、基于会话和基于数据包的方法，其中基于流与会话的方法无法满足实时性要求，而现有基于数据包的方法会侵犯用户隐私。为解决上述问题，我们提出一种仅通过IP包首部进行网络流量分类的方法，该方法同时满足用户隐私保护与在线分类性能的要求。通过统计分析，我们发现IP包首部信息对网络流量分类任务具有有效性，该结论亦通过实验得到验证。此外，我们提出一种新型外部注意力与卷积混合（ECM）模型用于在线网络流量分类。该模型采用低计算复杂度的外部注意力机制与卷积操作，分别提取流量分类所需的字节级与数据包级特征，从而在实现高分类精度的同时保持低时间消耗。实验表明，与当前最先进模型相比，ECM可获得最高的分类精度与最低的延迟。在两个数据集上的精度分别达到98.39%和95.57%，同时分类时间缩减至满足实时性要求。