A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> The basic objective of this work is to assess the utility of two supervised learning algorithms AdaBoost and RIPPER for classifying SSH traffic from log files without using features such as payload, IP addresses and source/destination ports. Pre-processing is applied to the traffic data to express as traffic flows. Results of 10-fold cross validation for each learning algorithm indicate that a detection rate of 99% and a false positive rate of 0.7% can be achieved using RIPPER. Moreover, promising preliminary results were obtained when RIPPER was employed to identify which service was running over SSH. Thus, it is possible to detect SSH traffic with high accuracy without using features such as payload, IP addresses and source/destination ports, where this represents a particularly useful characteristic when requiring generic, scalable solutions. <s> BIB001 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> The objective of this work is the comparison of two types of feature sets for the classification of encrypted traffic such as SSH. To this end, two learning algorithms – RIPPER and C4.5 – are employed using packet header and flow-based features. Traffic classification is performed without using features such as IP addresses, source/destination ports and payload information. Results indicate that the feature set based on packet header information is comparable with flow based feature set in terms of a high detection rate and a low false positive rate. <s> BIB002 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> The classification of Encrypted Traffic, namely Secure Shell (SSH), on the fly from network TCP traffic represents a particularly challenging application domain for machine learning. Solutions should ideally be both simple - therefore efficient to deploy - and accurate. Recent advances to teambased Genetic Programming provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain and increasing the throughput of solutions. Thus, in this work we have investigated the identification of SSH encrypted traffic based on packet header features without using IP addresses, port numbers and payload data. Evaluation of C4.5 and AdaBoost - representing current best practice - against the Symbiotic Bid-based (SBB) paradigm of team-based Genetic Programming (GP) under data sets common and independent from the training condition indicates that SBB based GP solutions are capable of providing simpler solutions without sacrificing accuracy. <s> BIB003 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> The objective of this work is to assess the robustness of machine learning based traffic classification for classifying encrypted traffic where SSH and Skype are taken as good representatives of encrypted traffic. Here what we mean by robustness is that the classifiers are trained on data from one network but tested on data from an entirely different network. To this end, five learning algorithms — AdaBoost, Support Vector Machine, Naie Bayesian, RIPPER and C4.5 — are evaluated using flow based features, where IP addresses, source/destination ports and payload information are not employed. Results indicate the C4.5 based approach performs much better than other algorithms on the identification of both SSH and Skype traffic on totally different networks. <s> BIB004 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> Classifying encrypted traffic is critical to effective network analysis and management. While traditional payload- based methods are powerless to deal with encrypted traffic, machine learning methods have been proposed to address this issue. However, these methods often bring heavy overhead into the system. In this paper, we propose a hybrid method that combines signature-based methods and statistical analysis methods to address this issue. We first identify SSL/TLS traffic with signature matching methods, and then apply statistical analysis to determine concrete application protocols. Our experimental results show that the proposed method is able to recognize over 99% of SSL/TLS traffic and achieve 94.52% in F-score for protocols identification. <s> BIB005 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> The classification of encrypted traffic on the fly from network traces represents a particularly challenging application domain. Recent advances in machine learning provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain. Thus, the objective of this work is to classify VoIP encrypted traffic, where Gtalk and Skype applications are taken as good representatives. To this end, three different machine learning based approaches, namely, C4.5, AdaBoost and Genetic Programming (GP), are evaluated under data sets common and independent from the training condition. In this case, flow based features are employed without using the IP addresses, source/destination ports and payload information. Results indicate that C4.5 based machine learning approach has the best performance. <s> BIB006 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> Application identification is paid much attention by network operators to manage application based traffic control in the Internet. However, encryption is one of the factors to make application identification difficult, because it is so hard to infer the original (unencrypted) packets from encrypted packets. Therefore the accuracy of application identification is getting worse as the increase of encrypted traffic. In this paper, the changes in traffic features due to encryption are analyzed, and two methods are developed that can be used with an existing method for identifying applications from encrypted traffic. Experimental results show that these methods improve identification accuracy up to 28.5% for encrypted traffic compared to existing methods. Moreover, identification using the best combination of flow features enables high accuracy with less computation due to the elimination of features that do not flow a Gaussian distribution and thus degrade accuracy. <s> BIB007 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> This work evaluates three methods for encrypted traffic analysis without using the IP addresses, port number, and payload information. To this end, binary identification of SSH vs non-SSH traffic is used as a case study since the plain text initiation of the SSH protocol allows us to obtain data sets with a reliable ground truth. The methods are subject to several tests using different export options, feature sets, and training and test traffic traces for a total of 128 different configurations. Of particular interest are test cases which that use a test set from a different network than that which the model was trained on, i.e. robustness of the trained models. Results show that the multi-objective genetic algorithm (MOGA) based trained model is able to achieve the best performance among the three methods when each approach is tested on traffic traces that are captured on the same network as the training network trace. On the other hand, C4.5 achieved the best results among the three methods when tested on traffic traces which are captured on totally different networks than the training trace. Furthermore, it is shown that continuous sampling of the training data is no better than random sampling, but the training data is very important for how well the classifiers will perform on traffic traces captured from different networks. Moreover, the C4.5 based approach provides the fastest and the most human readable model, whereas the MOGA reduces the complexity of the k-means clustering algorithm tremendously. <s> BIB008 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> Supervised Machine Learning Methods <s> Application identification in the middle is one of key challenges for network operators to manage application based traffic and policy controls in the Internet. However, it is becoming harder according to the increase of end-to-end encrypted traffic in which we hardly read application specific information from packets. We previously proposed a method to identify the application of traffic whenever the traffic is encrypted or not. Our method gives a significant accuracy of identification of encrypted traffic as high as the case when traffic is not encrypted, however, it requires an offline processing to obtain statistics of the whole of flows. A real-time identification is important, but the accuracy is a problem due to unstable information of flow statistics. In this paper we therefore propose an approach to improve the accuracy of identification when we identify the encrypted traffic in real-time. We first clarify the sufficient number of packets required for accurate identification, and then the method to infer the statistics to improve the accuracy even when the obtained number of packets is smaller than the one required. Experimental results have shown that the proposed approach achieves the high accuracy almost the same as in offline method. <s> BIB009
Sun et al. BIB005 propose a hybrid method for classifying encrypted traffic. First, the SSL/TLS protocol is recognized using a signature matching method. A Naive Bayes machine learning algorithm is then applied to identify the encrypted application protocol. The authors use a combination of public and private data sets to evaluate their method. Background traffic is taken from a public data set, BitTorrent, eDonkey, HTTP, FTP, Thunder and GRE application protocols. The signature based recognition of SSL/TLS protocols was tested on HTTPS, TOR, ICQ and other protocols. The identification of the underlying protocol was tested only for TOR and HTTPS protocols. Okada et al. BIB007 analyzed changes in flow features due to encryption. They created a training data set with HTTP, FTP, SSH, and SMTP application protocols encrypted using PPTP and IPsec tunnels. The authors assessed 49 flow features and analyzed which of them are strongly correlated in normal and encrypted traffic. The correlated features were then used to infer functions which transform the features between normal and encrypted traffic. Therefore, standard classifiers can be used to classify the traffic after the transformation. The authors verified their method using several modifications of the Naive Bayesian classifier. Arndt and Zincir-Heywood BIB008 also concentrated on the classification of encrypted traffic and compared C4.5, k-means and Multi-Objective Genetic Algorithm (MOGA) to this end. The classification of the SSH protocol was used as an example in their study. The authors focused on the accuracy and robustness of the algorithms. Stability was tested using three different public and private data sets for teaching and evaluating the methods. Multiple different flow export settings were tested as well. Altogether, 46 flow features were used in the evaluation, however, a different subset was used by each algorithm. The C4.5 algorithm provided the best robustness, although the MOGA had a very low false positive rate when used on the same data set as it was trained on. The C4.5 was recommended for forensic analysis by law enforcement since it is applicable on a variety of networks. Alshammari and Zincir-Heywood have published several papers BIB003 BIB001 BIB002 BIB004 BIB006  on traffic classification using various supervised machine learning methods. They focused on recognising SSH, Skype, and in one case, Gtalk traffic using flow features without port numbers, IP addresses or payloads. A set of 22 flow features was mostly used, although in one case the authors selected the features using genetic programming. Public data sets are used as well as a private data set generated on a test-bed network. The ground truth for public data sets was gained from port numbers, and the private data set includes the payload and was labelled with a commercial packet classification tool. The following algorithms for traffic classification were compared: AdaBoost, RIPPER, Support Vector Machine (SVM), Naive Bayes, C4.5 and Genetic Programming. Kumano et al. BIB009 investigated real-time application identification in encrypted traffic. IPsec and PPTP encryption were applied to web, interactive and bulk transfer flows to create an evaluation data set. C4.5 and SVM algorithms were utilized to classify the application on these data sets. The authors then tested the accuracy of the classification using a different number of packets from the start of the flows. They measured the impact of using fewer packets on the flow features and proposed using features which show the least change to classify applications at an early stage. 