CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Round 1

Reviewer 1 Report

The authors are proposing and discussing traffic classification and traffic analysis.
I believe authors need to revise their report majorly to highlight the characteristics of encrypted traffic data which are aimed to classified and improved by this work.
They need to provide sufficient evidence and data for each feature and the way they benchmark it.
Moreover, besides the data from the Canadian center, other captured data should be analyzed to make sure it is not biased and reliable.

Author Response

1. We mentioned some characteristics of encrypted traffic at the beginning of Section 3, which led to the classification model designed in this manuscript.
2. We did not do manual feature engineering, but intercepted the payload in the data packets. Regarding the benchmarking method, we verify the effectiveness of the model from several perspectives, including the number of BERT layers, the impact of pre-training on the results, the impact of the number of pre-training epochs on the results, and the necessity of each module in the model. As well as comparison with existing researches, this is a new addition in this revision.
3. We are sorry that we did not choose other datasets for verification, because we found that most of the existing researches only selected one dataset, and the dataset we selected is public, so the results are reproducible. At the same time, this revision adds a comparison with other existing studies and can also verify the robustness of the model to a certain extent.

Reviewer 2 Report

The subject of the paper is interesting but I have minor and major concerns. Minor concerns are:

-              The English language is very poor

-              Some references are missing

Please see the attached file

My major concern is that the you compare the proposed method against another one you have recently published (Ref 11). This is not a correct approach. You should compare their proposed method against other state-of-the-art (you report some in the related work) by conducting experiments under the same conditions (datasets etc.).

Moreover, the related work should be strengthened. For example, although Section 2.1 is entitled “Applications of Machine Learning and Deep Learning”, there is not even one machine learning related work.

Comments for author File: Comments.pdf

Author Response

We are deeply sorry for the poor English writing. In this revision, we have tried our best to complete the parts that you mentioned that need to be revised.
1. We have made amendments one by one in accordance with the issues mentioned in the attachment. Among them, Line 85-86 feature selection and feature extraction → feature extraction and feature selection. We believe that feature extraction and feature selection are both to find the most effective features from the original features. The difference between them is that feature extraction emphasizes obtaining a set of features with obvious physical or statistical significance through feature conversion; while feature selection is to select a subset of features with obvious physical or statistical significance from the feature set. Both can help reduce the dimension of features and data redundancy. Feature extraction can sometimes find more meaningful feature attributes. The process of feature selection can often indicate the importance of each feature for model construction. Therefore, the two are in a parallel relationship, and the order of the front and back has little effect, but we still changed to feature extraction and feature selection according to your suggestion.
2. We have added references to several public datasets mentioned in the manuscript, and Facebook and Skype have also changed to hyperlinks.
3. We generally changed the tense of the Section 2 to the past tense. The beginning of Section 2 and the title of Section 2.1 have been modified. Because our proposed model is based on deep learning, we hope to start with the summary of deep learning applications, so the title deletes machine learning.
4. In Table 2, 3, 4, we bolded the best results in each metrics.
5. We generally changed the tense of Conclusion to the past tense.
6. Regarding the comparative experiment part, we mentioned in this revision that the comparison with reference [14] was implemented in the same dataset. At the same time, at the end of Section 4.3, we have added comparisons with existing studies, and the selected comparison models are all derived from the methods mentioned in Related Work.

Round 2

Reviewer 1 Report

My concerns are addressed.

Author Response

Thank you for your review comments, which are of great help to my revision.

Reviewer 2 Report

• You have addressed all my minor concerns. However, you should give the manuscript to a native English speaker to proofread it.
• Regarding the experiments i see that you compare your work against others as i suggested. I would like to know whether you performed the experiments (of the added methods) on your dataset or you report the results as in the relevant papers. In the latter case, i would like to know whether the dataset is the same you have used or not. 

Author Response

We found some high-level English-speaking personnel for related research, as well as some native English-speaking researchers. They suggested some amendments to our manuscript and refined it.

Regarding the comparative experiments, we have added that several models were implemented on the same dataset mentioned in the manuscript. The reasons for the unsatisfactory performance of these models may be as follows:
1. The sample size of our data set is small, only 0.4. A small sample size of data will increase the difficulty of model learning.
2. One of our samples contains 10 consecutive packets, only the payload information is analyzed, without header information, and no packets in the handshake phase. However, several comparison models may not randomly select packets in their own experiments, and not only include the payload, but also other information. Our experiments are more in line with the real situation, which leads to the unsatisfactory effects of several existing models.