Identification of application in encrypted traffic by using machine learning

Abstract

Identification of Internet protocol from raw network traffic plays a crucial role at maintaining and improving the security of back-end and front-end computer systems. A significant amount of research work is carried out while exploiting a variety of identification techniques. Although certain level in success at detection of network protocols for unencrypted traffic has been achieved, accuracy and performance is rather poor for encrypted traffic. But considering technological trends, new and existing applications have been adopted to use encryption mechanism to protect information and privacy. Therefore, classification of encrypted network traffic is mandatory for security purposes. In this study, we propose a method for automatic extraction of features from raw network capture and accurate identification of network applications by applying machine learning algorithms. The proposed method is evaluated with two independent datasets. The first dataset is publicly available (known as NISM dataset) and the second dataset is generated with a particular emphasis on accurate labeling of network traffic, it contains 713851 and 448 network flows, respectively. The proposed method classifies network flows provided by the first dataset into their corresponding application categories with the accuracy over 0.997 and F1-score of 0.99, the second dataset with an accuracy over 0.96 and F1-score of 0.95.