CGNN: Traffic Classification with Graph Neural Network
  Traffic classification associates packet streams with known application
labels, which is vital for network security and network management. With the
rise of NAT, port dynamics, and encrypted traffic, it is increasingly
challenging to obtain unified traffic features for accurate classification.
Many state-of-the-art traffic classifiers automatically extract features from
the packet stream based on deep learning models such as convolution networks.
Unfortunately, the compositional and causal relationships between packets are
not well extracted in these deep learning models, which affects both prediction
accuracy and generalization on different traffic types.
  In this paper, we present a chained graph model on the packet stream to keep
the chained compositional sequence. Next, we propose CGNN, a graph neural
network based traffic classification method, which builds a graph classifier
over automatically extracted features over the chained graph.
  Extensive evaluation over real-world traffic data sets, including normal,
encrypted and malicious labels, show that, CGNN improves the prediction
accuracy by 23\% to 29\% for application classification, by 2\% to 37\% for
malicious traffic classification, and reaches the same accuracy level for
encrypted traffic classification. CGNN is quite robust in terms of the recall
and precision metrics. We have extensively evaluated the parameter sensitivity
of CGNN, which yields optimized parameters that are quite effective for traffic
classification.
