{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T20:58:08Z","timestamp":1791925088579,"version":"4.3.4"},"reference-count":33,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T00:00:00Z","timestamp":1693526400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"State Key Laboratory of Millimeter Waves","award":["K202219"],"award-info":[{"award-number":["K202219"]}]},{"name":"State Key Laboratory of Millimeter Waves","award":["21KJD510001"],"award-info":[{"award-number":["21KJD510001"]}]},{"name":"Natural Science Foundation of the Jiangsu Higher Education Institutions of China","award":["K202219"],"award-info":[{"award-number":["K202219"]}]},{"name":"Natural Science Foundation of the Jiangsu Higher Education Institutions of China","award":["21KJD510001"],"award-info":[{"award-number":["21KJD510001"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Network traffic classification (NTC) has attracted great attention in many applications such as secure communications, intrusion detection systems. The existing NTC methods based on supervised learning rely on sufficient labeled datasets in the training phase, but for most traffic datasets, it is difficult to obtain label information in practical applications. Although unsupervised learning does not rely on labels, its classification accuracy is not high, and the number of data classes is difficult to determine. This paper proposes an unsupervised NTC method based on adversarial training and deep clustering with improved network traffic classification (NTC) and lower computational complexity in comparison with the traditional clustering algorithms. Here, the training process does not require data labels, which greatly reduce the computational complexity of the network traffic classification through pretraining. In the pretraining stage, an autoencoder (AE) is used to reduce the dimension of features and reduce the complexity of the initial high-dimensional network traffic data features. Moreover, we employ the adversarial training model and a deep clustering structure to further optimize the extracted features. The experimental results show that our proposed method has robust performance, with a multiclassification accuracy of 92.2%, which is suitable for classification with a large number of unlabeled data in actual application scenarios. This paper only focuses on breakthroughs in the algorithm stage, and future work can be focused on the deployment and adaptation in practical environments.<\/jats:p>","DOI":"10.3390\/fi15090298","type":"journal-article","created":{"date-parts":[[2023,9,1]],"date-time":"2023-09-01T08:45:31Z","timestamp":1693557931000},"page":"298","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Intelligent Unsupervised Network Traffic Classification Method Using Adversarial Training and Deep Clustering for Secure Internet of Things"],"prefix":"10.3390","volume":"15","author":[{"given":"Weijie","family":"Zhang","sequence":"first","affiliation":[{"name":"Reading Academy, Nanjing University of Information Science and Technology, Nanjing 210044, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lanping","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications, Nanjing 210003, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xixi","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications, Nanjing 210003, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications, Nanjing 210003, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pengfei","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications, Nanjing 210003, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7428-4980","authenticated-orcid":false,"given":"Guan","family":"Gui","sequence":"additional","affiliation":[{"name":"College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications, Nanjing 210003, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,9,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"359","DOI":"10.1109\/JIOT.2021.3103320","article-title":"6G internet of things: A comprehensive survey","volume":"9","author":"Nguyen","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"11891","DOI":"10.1109\/JIOT.2021.3063686","article-title":"Enabling massive IoT toward 6G: A comprehensive survey","volume":"8","author":"Guo","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"119771","DOI":"10.1016\/j.eswa.2023.119771","article-title":"A survey of deep learning-based intrusion detection in automotive applications","volume":"221","author":"Lampe","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"280","DOI":"10.1109\/COMST.2021.3139052","article-title":"Surveying Trust-Based Collaborative Intrusion Detection: State-of-the-Art, Challenges and Future Directions","volume":"24","author":"Li","year":"2022","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"9310","DOI":"10.1109\/JIOT.2021.3130434","article-title":"Hierarchical adversarial attacks against graph-neural-network-based IoT network intrusion detection system","volume":"9","author":"Zhou","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"3930","DOI":"10.1109\/JIOT.2021.3100755","article-title":"Federated deep learning for zero-day botnet attack detection in IoT edge devices","volume":"9","author":"Popoola","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1109\/SURV.2008.080406","article-title":"A survey of techniques for internet traffic classification using machine learning","volume":"10","author":"Nguyen","year":"2008","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1016\/j.comnet.2019.04.004","article-title":"An innovative approach for real-time network traffic classification","volume":"158","author":"Dias","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Pasyuk, A., Semenov, E., and Tyuhtyaev, D. (2019, January 1\u20134). Feature selection in the classification of network traffic flows. Proceedings of the International Multi-Conference on Industrial Engineering and Modern Technologies (FarEastCon), Vladivostok, Russia.","DOI":"10.1109\/FarEastCon.2019.8934169"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1145\/1071690.1064220","article-title":"Internet traffic classification using bayesian analysis techniques","volume":"33","author":"Moore","year":"2005","journal-title":"ACM Sigmetrics Perform. Eval. Rev."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"39501","DOI":"10.1109\/ACCESS.2018.2855437","article-title":"A Survey of Clustering With Deep Learning: From the Perspective of Network Architecture","volume":"6","author":"Min","year":"2018","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Karagiannis, T., Broido, A., Faloutsos, M., and Klaffy, K. (2004, January 25\u201327). Transport Layer Identification of P2P Traffic. Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement (IMC 2004), Taormina Sicily, Italy.","DOI":"10.1145\/1028788.1028804"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1158","DOI":"10.1016\/j.comnet.2010.11.006","article-title":"Quantifying the accuracy of the ground truth associated with Internet traffic traces","volume":"55","author":"Dusi","year":"2011","journal-title":"Comput. Netw."},{"key":"ref_14","unstructured":"Dreger, H., Feldmann, A., Mai, M., Paxson, V., and Sommer, R.R. (August, January 31). Dynamic application layer protocol analysis for network intrusion detection. Proceedings of the USENIX Security Symposium, Vancouver, BC, Canada."},{"key":"ref_15","unstructured":"Madhukar, A., and Williamson, C. (2006, January 11\u201314). A longitudinal study of P2P traffic classification. Proceedings of the 14th IEEE International Symposium on Modeling, Analysis, and Simulation, Monterey, CA, USA."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"316","DOI":"10.1109\/90.330413","article-title":"Empirically derived analytic models of wide-area TCP connections","volume":"2","author":"Paxson","year":"1994","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1962","DOI":"10.1109\/TNSM.2021.3052888","article-title":"Adversarial network traffic: Towards evaluating the robustness of deep-learning-based network traffic classification","volume":"18","author":"Sadeghzadeh","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2838","DOI":"10.1109\/TCOMM.2020.2974457","article-title":"Sparse channel estimation and hybrid precoding using deep learning for millimeter wave massive MIMO","volume":"68","author":"Ma","year":"2020","journal-title":"IEEE Trans. Commun."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"9960","DOI":"10.1109\/JIOT.2021.3119055","article-title":"A novel intrusion detection method based on lightweight neural network for internet of things","volume":"9","author":"Zhao","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"17058","DOI":"10.1109\/JIOT.2021.3131981","article-title":"Malware traffic classification using domain adaptation and ladder network for secure industrial internet of things","volume":"9","author":"Ning","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Huang, P., Huang, Y., Wang, W., and Wang, L. (2014, January 24\u201328). Deep embedding network for clustering. Proceedings of the 22nd International Conference on Pattern Recognition, Stockholm, Sweden.","DOI":"10.1109\/ICPR.2014.272"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1109\/MNET.2018.1800078","article-title":"An improved stacked auto-encoder for network traffic flow classification","volume":"32","author":"Li","year":"2018","journal-title":"IEEE Netw."},{"key":"ref_23","unstructured":"Shah, S., and Koltun, V. (2018, March 05). Deep Continuous Clustering. Available online: https:\/\/arxiv.org\/abs\/1803.01449."},{"key":"ref_24","unstructured":"Srivastava, R., Greff, K., and Schmidhuber, J. (2015, January 7\u201312). Training very deep networks. Proceedings of the Neural Information Processing Systems (NIPS), Red Hook, NY, USA."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1529","DOI":"10.1109\/TNSRE.2019.2929081","article-title":"Compact and low-power neural spike compression using undercomplete autoencoders","volume":"27","author":"Thies","year":"2019","journal-title":"IEEE Trans. Neural Syst. Rehabil. Eng."},{"key":"ref_26","unstructured":"Wang, W., Zhu, M., Zeng, X., Ye, X., and Sheng, Y. (2017, January 11\u201313). Malware traffic classification using convolutional neural network for representation learning. Proceedings of the International Conference on Information Networking (ICOIN), Da Nang, Vietnam."},{"key":"ref_27","unstructured":"Ren, Y., Pu, J., Yang, Z., Li, G., Pu, X., Yu, P., and He, L. (2022, October 09). Deep Clustering: A Comprehensive Survey. Available online: https:\/\/arxiv.org\/abs\/2210.04142."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Hoang, D.H., and Nguyen, H.D. (2019, January 17\u201320). Detecting anomalous network traffic in IoT networks. Proceedings of the International Conference on Advanced Communication Technology (ICACT), PyeongChang, Republic of Korea.","DOI":"10.23919\/ICACT.2019.8702032"},{"key":"ref_29","unstructured":"Peng, X., Xiao, S., Feng, J., Yau, W.-Y., and Yi, Z. (2016, January 9\u201315). Deep subspace clustering with sparsity prior. Proceedings of the International Joint Conferences on Artificial Intelligence Organization (IJCAI), New York, NY, USA."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yao, R., Liu, C., Zhang, L., and Peng, P. (2019, January 17\u201320). Unsupervised anomaly detection using variational auto-encoder based feature extraction. Proceedings of the IEEE International Conference on Prognostics and Health Management (ICPHM), San Francisco, CA, USA.","DOI":"10.1109\/ICPHM.2019.8819434"},{"key":"ref_31","unstructured":"Yang, B., Fu, X., Sidiropoulos, N.D., and Hong, M. (2017, January 6\u201311). Towards K-means-friendly spaces: Simultaneous deep learning and clustering. Proceedings of the 34th International Conference on Machine Learning (ICML 2017), Sydney, Australia."},{"key":"ref_32","first-page":"1680","article-title":"Adaptive self-paced deep clustering with data augmentation","volume":"32","author":"Guo","year":"2020","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"1258","DOI":"10.1109\/TASSP.1984.1164450","article-title":"Combinatorial optimization: Algorithms and complexity","volume":"32","author":"Rabiner","year":"1984","journal-title":"IEEE Trans. Acoust. Speech Signal Process."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/9\/298\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:44:47Z","timestamp":1760129087000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/9\/298"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,1]]},"references-count":33,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2023,9]]}},"alternative-id":["fi15090298"],"URL":"https:\/\/doi.org\/10.3390\/fi15090298","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,1]]}}}