VPN Network Traffic Classification Using Entropy Estimation and Time-Related Features

Abstract

The classification of Internet traffic is gaining prominence for the past few years due to the widening of the current Internet network and web-based applications. Many different approaches are being practiced based on the numerous studies conducted so far. The newer methodology can become imperative for service providers to offer a better quality of service to the users. Deep packet inspection is one such methodology used in the past for traffic characterization where network traffic is subsequently classified into different classes, but their accuracy has been declined due to the drastic changes in the Internet traffic, particularly the increase in encrypted traffic. Virtual private networks (VPNs) have become a preferred choice among the users for remote access communication over other public Internet or IP-based networks. In this paper, our proposed model is a combined approach of entropy estimation and machine learning algorithms, especially deep learning for the network traffic classification. We have used the time-related features to classify VPN or non-VPN network traffic and characterize encrypted traffic into different categories and application identification. We used random forest, KNN, and ANN to test the accuracy of our model. Our results show a good accuracy rate and performance and thus proved our proposed model with entropy as an additional feature, achieving accuracy levels above 90% for all the three algorithms to characterize VPN or non-VPN traffic and application identification.