WeChat Traffic Deciphered: Distinguishing Text and Images via Machine Learning
WeChat Text and Picture Messages Service Flow Traffic Classification Using Machine Learning Technique
This paper presents a novel study on classifying WeChat text and picture message traffic using machine learning. By collecting real-world datasets (HIT and Dorm13) and extracting 50 flow-based features, the authors evaluate four classifiers—C4.5, Bayes Net, Naïve Bayes, and SVM—achieving a Peak accuracy of 99.91% with C4.5.
TL;DR
With over 650 million active users (at the time of the study), WeChat dominates mobile traffic, yet identifying its specific sub-services remained a challenge. This paper presents the first successful attempt to classify WeChat text and picture messages using flow-based machine learning, achieving an impressive 99.9% accuracy using the C4.5 Decision Tree algorithm.
Executive Summary
Network traffic classification is the backbone of modern ISP management and cybersecurity. While previous works focused on legacy services like SMS or MSN, the researchers from Harbin Institute of Technology (HIT) turned their gaze toward WeChat. By comparing four major algorithms (C4.5, SVM, Bayes Net, and Naïve Bayes) across two different network environments, they proved that even without looking at the message content, the "shape" of the traffic is enough to identify its purpose.
The Challenge: Why WeChat is Different
Traditional traffic identification often relied on Deep Packet Inspection (DPI) or port-based analysis. However, modern apps use encryption and dynamic porting, rendering these methods obsolete. The difficulty lies in the subtle differences between a "Text Message" flow and a "Picture Message" flow—both belong to the same app, but they have distinct signatures in terms of packet size, inter-arrival time, and burstiness.
Methodology: From Packets to 50-Dimensional Features
The authors adopted a workflow focused on Statistical Flow Properties:
- Data Collection: Traffic was captured in two environments: a controlled Research Lab (HIT) and a busy Dormitory (Dorm13).
- Feature Engineering: Using
NetMate, they extracted 44 features and manually added 6 more, totaling 50 features (e.g., flow duration, packet counts, byte frequencies). - Classification: They employed 10-fold cross-validation to ensure the models were not just memorizing the data but actually learning patterns.
Figure 1: While Naïve Bayes is structurally simple (as shown above), its assumption of feature independence often limits its accuracy in complex network flows.
Battle of the Algorithms: Results
The study highlights a clear hierarchy in performance. While Bayesian methods are computationally cheap, they struggle with the high dimensionality of network traffic.
| Classifier | HIT Accuracy | Dorm13 Accuracy | Training Time (Sec) |
|---|---|---|---|
| C4.5 | 99.91% | 99.97% | 0.09 - 0.15 |
| SVM | 99.57% | 100% | 0.29 - 0.42 |
| Bayes Net | 65.82% | 66.12% | 0.06 - 0.16 |
| Naïve Bayes | 71.41% | 53.97% | 0.04 - 0.05 |
Key Insights from Results:
- The Power of Trees: C4.5 consistently outperformed others because decision trees are excellent at finding non-linear thresholds in flow features (e.g., "if packet size > X and duration < Y, it's a picture").
- Precision and Recall: As seen in the graphs below, C4.5 and SVM maintained near-perfect recall, meaning they rarely missed a message or misclassified it.
Figure 2: The Recall metrics for HIT dataset demonstrate that C4.5 and SVM are significantly more robust than Bayesian learners.
Critical Analysis & Future Outlook
Takeaway: This research successfully moves the needle from "App Identification" to "Sub-service Identification." For ISPs, this means the ability to prioritize text messages during congestion while perhaps de-prioritizing heavy image/video uploads.
Limitations:
- The study uses a 50-feature set which might be computationally heavy for real-time line-rate classification at the Tbps scale.
- The datasets were collected in 2016; WeChat's protocol has likely evolved with stronger obfuscation since then.
Future Work: The logical next step is applying Deep Learning (specifically 1D-CNNs or LSTMs) to raw packet sequences, eliminating the need for manual feature extraction with tools like NetMate. Furthermore, expanding this to WeChat's "Mini Programs" and "Video Accounts" will be crucial for modern network management.