A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> We present a fundamentally different approach to classifying traffic flows according to the applications that generate them. In contrast to previous methods, our approach is based on observing and identifying patterns of host behavior at the transport layer. We analyze these patterns at three levels of increasing detail (i) the social, (ii) the functional and (iii) the application level. This multilevel approach of looking at traffic flow is probably the most important contribution of this paper. Furthermore, our approach has two important features. First, it operates in the dark, having (a) no access to packet payload, (b) no knowledge of port numbers and (c) no additional information other than what current flow collectors provide. These restrictions respect privacy, technological and practical constraints. Second, it can be tuned to balance the accuracy of the classification versus the number of successfully classified traffic flows. We demonstrate the effectiveness of our approach on three real traces. Our results show that we are able to classify 80%-90% of the traffic with more than 95% accuracy. <s> BIB001 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The basic objective of this work is to assess the utility of two supervised learning algorithms AdaBoost and RIPPER for classifying SSH traffic from log files without using features such as payload, IP addresses and source/destination ports. Pre-processing is applied to the traffic data to express as traffic flows. Results of 10-fold cross validation for each learning algorithm indicate that a detection rate of 99% and a false positive rate of 0.7% can be achieved using RIPPER. Moreover, promising preliminary results were obtained when RIPPER was employed to identify which service was running over SSH. Thus, it is possible to detect SSH traffic with high accuracy without using features such as payload, IP addresses and source/destination ports, where this represents a particularly useful characteristic when requiring generic, scalable solutions. <s> BIB002 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> Most tools to recognize the application associated with network connections use well-known signatures as basis for their classification. This approach is very effective in enterprise and campus networks to pinpoint forbidden applications (peer to peer, for instance) or security threats. However, it is easy to use encryption to evade these mechanisms. In particular, Secure Sockets Layer (SSL) libraries such as OpenSSL are widely available and can easily be used to encrypt any type of traffic. In this paper, we propose a method to detect applications in SSL encrypted connections. Our method uses only the size of the first few packets of an SSL connection to recognize the application, which enables an early classification. We test our method on packet traces collected on two campus networks and on manually-encrypted traces. Our results show that we are able to recognize the application in an SSL connection with more than 85% accuracy. <s> BIB003 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The objective of this work is the comparison of two types of feature sets for the classification of encrypted traffic such as SSH. To this end, two learning algorithms – RIPPER and C4.5 – are employed using packet header and flow-based features. Traffic classification is performed without using features such as IP addresses, source/destination ports and payload information. Results indicate that the feature set based on packet header information is comparable with flow based feature set in terms of a high detection rate and a low false positive rate. <s> BIB004 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The classification of Encrypted Traffic, namely Secure Shell (SSH), on the fly from network TCP traffic represents a particularly challenging application domain for machine learning. Solutions should ideally be both simple - therefore efficient to deploy - and accurate. Recent advances to teambased Genetic Programming provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain and increasing the throughput of solutions. Thus, in this work we have investigated the identification of SSH encrypted traffic based on packet header features without using IP addresses, port numbers and payload data. Evaluation of C4.5 and AdaBoost - representing current best practice - against the Symbiotic Bid-based (SBB) paradigm of team-based Genetic Programming (GP) under data sets common and independent from the training condition indicates that SBB based GP solutions are capable of providing simpler solutions without sacrificing accuracy. <s> BIB005 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The objective of this work is to assess the robustness of machine learning based traffic classification for classifying encrypted traffic where SSH and Skype are taken as good representatives of encrypted traffic. Here what we mean by robustness is that the classifiers are trained on data from one network but tested on data from an entirely different network. To this end, five learning algorithms — AdaBoost, Support Vector Machine, Naie Bayesian, RIPPER and C4.5 — are evaluated using flow based features, where IP addresses, source/destination ports and payload information are not employed. Results indicate the C4.5 based approach performs much better than other algorithms on the identification of both SSH and Skype traffic on totally different networks. <s> BIB006 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The increasing use of encrypted traffic combined with non-standard port associations makes the task of traffic identification increasingly difficult. This work adopts a multi-objective clustering approach to the problem in which a Genetic Algorithm performs both feature selection and cluster count optimization under a flow based representation. Solutions do not use port numbers, IP address or payload. Performance of the resulting model provides 90% detection 0.8% false positive rates with 13 clusters supported by 14 of the original 38 features. <s> BIB007 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The identification of application flows is a critical task in order to manage bandwidth requirements of different kind of services (i.e. VOIP, Video, ERP). As network security functions spread, an increasing amount of traffic is natively encrypted due to privacy issues (e.g. VPN). This makes ineffective current traffic classification systems based on ports and payload inspection, e.g. even powerful Deep Packet Inspection is useless to classify application flow carried inside SSH sessions. We have developed a real time traffic classification method based on cluster analysis to identify SSH flows from statistical behavior of IP traffic parameters, such as length, arrival times and direction of packets. In this paper we describe our approach and relevant obtained results. We achieve detection rate up to 99.5 % in classifying SSH flows and accuracy up to 99.88 % for application flows carried within those flows, such as SCP, SFTP and HTTP over SSH. <s> BIB008 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The classification of encrypted traffic on the fly from network traces represents a particularly challenging application domain. Recent advances in machine learning provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain. Thus, the objective of this work is to classify VoIP encrypted traffic, where Gtalk and Skype applications are taken as good representatives. To this end, three different machine learning based approaches, namely, C4.5, AdaBoost and Genetic Programming (GP), are evaluated under data sets common and independent from the training condition. In this case, flow based features are employed without using the IP addresses, source/destination ports and payload information. Results indicate that C4.5 based machine learning approach has the best performance. <s> BIB009 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> Classifying encrypted traffic is critical to effective network analysis and management. While traditional payload- based methods are powerless to deal with encrypted traffic, machine learning methods have been proposed to address this issue. However, these methods often bring heavy overhead into the system. In this paper, we propose a hybrid method that combines signature-based methods and statistical analysis methods to address this issue. We first identify SSL/TLS traffic with signature matching methods, and then apply statistical analysis to determine concrete application protocols. Our experimental results show that the proposed method is able to recognize over 99% of SSL/TLS traffic and achieve 94.52% in F-score for protocols identification. <s> BIB010 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> Classifying network flows by their application type is the backbone of many crucial network monitoring and controlling tasks, including billing, quality of service, security and trend analyzers. The classical “port-based” and “payload-based” approaches to traffic classification have several shortcomings. These limitations have motivated the study of classification techniques that build on the foundations of learning theory and statistics. The current paper presents a new statistical classifier that allows real time classification of encrypted data. Our method is based on a hybrid combination of the k-means and k-nearest neighbor (or k-NN) geometrical classifiers. The proposed classifier is both fast and accurate, as implied by our feasibility tests, which included implementing and intergrading statistical classification into a realtime embedded environment. The experimental results indicate that our classifier is extremely robust to encryption. <s> BIB011 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> The network community always pays its attention to find better methods for traffic classification, which is crucial for Internet Service Providers (ISPs) to provide better QoS for users. Prior works on traffic classification mainly focus their attentions on dividing Internet traffic into different categories based on application layer protocols (such as HTTP, Bit Torrent etc.). Making traffic classification from another point of view, we divide Internet traffic into different content types. Our technology is an attempt to solve the classification problem of network traffic, which contains unknown and proprietary protocols (i.e., no publicly available protocol specification). In this paper, we design a classifier which can distinguish Internet traffic into different content types using machine learning techniques. Features of our classifier are entropy of consecutive bytes and frequencies of characters. Our method is capable of classifying real-world traces into different content types (including Text, Picture, Audio, Video, Compressed, Base 64-encoded image, Base 64-encoded text and Encrypted). The chief features of our classifier are small computing space (about 1K Bytes) and high classification accuracy (about 81%). <s> BIB012 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> This work evaluates three methods for encrypted traffic analysis without using the IP addresses, port number, and payload information. To this end, binary identification of SSH vs non-SSH traffic is used as a case study since the plain text initiation of the SSH protocol allows us to obtain data sets with a reliable ground truth. The methods are subject to several tests using different export options, feature sets, and training and test traffic traces for a total of 128 different configurations. Of particular interest are test cases which that use a test set from a different network than that which the model was trained on, i.e. robustness of the trained models. Results show that the multi-objective genetic algorithm (MOGA) based trained model is able to achieve the best performance among the three methods when each approach is tested on traffic traces that are captured on the same network as the training network trace. On the other hand, C4.5 achieved the best results among the three methods when tested on traffic traces which are captured on totally different networks than the training trace. Furthermore, it is shown that continuous sampling of the training data is no better than random sampling, but the training data is very important for how well the classifiers will perform on traffic traces captured from different networks. Moreover, the C4.5 based approach provides the fastest and the most human readable model, whereas the MOGA reduces the complexity of the k-means clustering algorithm tremendously. <s> BIB013 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> An important part of network management requires the accurate identification and classification of network traffic for decisions regarding bandwidth management, quality of service, and security. This work explores the use of a Multi-Objective Genetic Algorithm (MOGA) for both, feature selection and cluster count optimization, for an unsupervised machine learning technique, K-Means, applied to encrypted traffic identification. Specifically, a hierarchical K-Means algorithm is employed, comparing its performance to the MOGA with a non-hierarchical (flat) K-Means algorithm. The latter has already been benchmarked against common unsupervised techniques found in the literature, where results have favored the proposed MOGA. The purpose of this paper is to explore the gains, if any, obtained by increasing cluster purity in the proposed model by means of a second layer of clusters. In this work, SSH is chosen as an example of an encrypted application. However, nothing prevents the proposed model to work with other types of encrypted traffic, such as SSL or Skype. Results show that with the hierarchical MOGA, significant gains are observed in terms of the classification performance of the system. <s> BIB014 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> Classification analysis of network traffic based on port number or payload is becoming increasingly difficult from security to quality of service measurements, because of using dynamic port numbers, masquerading and various cryptographic techniques to avoid detection. Research tends to analyze flow statistical features with machine learning techniques. Clustering approaches do not require complex training procedure and large memory cost. However, the performance of clustering algorithm like k-Means still have own disadvantages. We propose a novel approach of considering harmonic mean as distance matric, and evaluate it in terms of three metrics on real-world encrypted traffic. The result shows the classification has better performance compared with the previously. <s> BIB015 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> In this paper, we consider the problem of detecting Skype traffic and classifying Skype service flows such as voice calls, skypeOut, video conferencing, chat, file upload and download. We propose a classification method for Skype encrypted traffic based on the Statistical Protocol IDentification (SPID) that analyzes statistical values of some traffic attributes. We have evaluated our method on a representative dataset to show excellent performance in terms of Precision and Recall. <s> BIB016 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> In this paper, we propose stochastic fingerprints for application traffic flows conveyed in Secure Socket Layer/Transport Layer Security (SSL/TLS) sessions. The fin- gerprints are based on first-order homogeneous Markov chains for which we identify the parameters from observed training application traces. As the fingerprint parameters of chosen applications considerably differ, the method results in a very good accuracy of application discrimination and provides a possibility of detecting abnormal SSL/TLS sessions. Our analysis of the results reveals that obtaining application discrimination mainly comes from incorrect implementation practice, the misuse of the SSL/TLS protocol, various server configurations, and the application nature. fingerprints of sessions to classify application traffic. We call a fingerprint any distinctive feature allowing identification of a given traffic class. In this work, a fingerprint corresponds to a first-order homogeneous Markov chain reflecting the dynamics of an SSL/TLS session. The Markov chain states model a sequence of SSL/TLS message types appearing in a single direction flow of a given application from a server to a client. We have studied the Markov chain fingerprints for twelve representative applications that make use of SSL/TLS: PayPal (an electronic service allowing online payments and money transfers), Twitter (an online social networking and micro- blogging service), Dropbox (a file hosting service), Gadu- Gadu (a popular Polish instant messenger), Mozilla (a part of Mozilla add-ons service responsible for verification of the software version), MBank and PKO (two popular European online banking services), Dziekanat (student online service), Poczta (student online mail service), Amazon S3 (a Simple Storage Service) and EC2 (an Elastic Compute Cloud), and Skype (a VoIP service). The resulting models exhibit a specific structure allowing to classify encrypted application flows by comparing its message sequences with fingerprints. They can also serve to reveal intrusions trying to exploit the SSL/TLS protocol by establishing abnormal communications with a server. <s> BIB017 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> A Summary of Machine Learning and Statistical Encrypted Traffic Classification <s> Application identification in the middle is one of key challenges for network operators to manage application based traffic and policy controls in the Internet. However, it is becoming harder according to the increase of end-to-end encrypted traffic in which we hardly read application specific information from packets. We previously proposed a method to identify the application of traffic whenever the traffic is encrypted or not. Our method gives a significant accuracy of identification of encrypted traffic as high as the case when traffic is not encrypted, however, it requires an offline processing to obtain statistics of the whole of flows. A real-time identification is important, but the accuracy is a problem due to unstable information of flow statistics. In this paper we therefore propose an approach to improve the accuracy of identification when we identify the encrypted traffic in real-time. We first clarify the sufficient number of packets required for accurate identification, and then the method to infer the statistics to improve the accuracy even when the obtained number of packets is smaller than the one required. Experimental results have shown that the proposed approach achieves the high accuracy almost the same as in offline method. <s> BIB018
We have provided a summarizing overview of the feature-based traffic classification papers and methods they use in Table IV . Where a method belongs to multiple categories, it is not marked as a hybrid, but all the categories are listed instead. We find this approach more descriptive than using a hybrid category as defined by the taxonomy. Most surveyed methods use flow or packet header features as an input for the classification techniques. The authors of BIB004  compare the results gained by utilizing packet header features and flow features. They show that using both sets of features can result in faster and more accurate classification algorithms. Nevertheless, using all the available traffic features does not necessarily lead to the best classification performance as demonstrated by the authors of BIB005 . The column Number of features shows how many flow or packet header features were used in each method. Some methods used different subsets of the features for different algorithms, and this is denoted by the ⊆ mark. Moreover, some of the methods used a feature selection algorithm to select the best combination of features from the entire feature set. These methods are marked in the Feature selection column. For this case, the Number of features column represents the initial number of features. Most classification algorithms are based on machine learning. The category of supervised machine learning algorithms is represented by Hidden Markov Models, RIPPER, AdaBoost, Support Vector Machines, C4.5 and Naive Bayes. Several works BIB002 BIB006 BIB009  ] compare these algorithms to establish which is the best for the task of classifying traffic. The C4.5 algorithm performs the best in several cases, however, genetic programming is reported to achieve the best results in  . The second most common algorithm category is the semi-supervised machine learning, which is dominated by clustering algorithms. The k-means algorithm is the most frequent in this category, and the k-nearest neighbour comes second. The popularity of k-means is due to its variability, which allows it to be fine-tuned for various purposes. It is often combined with genetic algorithms to find the best setting. The authors of BIB012  use the entropy of packet payloads to classify traffic. Using simple statistical properties of the traffic is the third most common classification method. Other methods are rarely used, mainly because they cannot learn from labelled traffic and therefore require too much effort to set up. The SSH protocol is heavily used as a classification example. The authors of BIB005 BIB002 BIB004 BIB006  BIB013 BIB007 BIB014 BIB015 test their methods for recognising SSH and non-SSH traffic. Maiolini et al. BIB008 take the classification one step further and identify the type of traffic encapsulated in a SSH connection. The authors of BIB003 BIB017 BIB010 use SSL/TLS traffic and identify underlying application protocols. Since the SSL/TLS protocol is more general and is used to encrypt various types of traffic, the complexity of identification is higher than for SSH. Another very popular protocol for identification is Skype, which is addressed by the authors of BIB006  BIB016 BIB017 . Some of the methods focus only on identifying encrypted traffic, whereas others try to identify the underlying application protocol. The methods which perform a more thorough analysis to gain information about the application protocol are indicated in the column Encrypted protocol identification. Because all methods, with the exception of BIB001 , classify whole flows and rely mostly on flow features, they are rarely able to classify traffic in real-time. However, the authors of BIB011 BIB003 BIB018 BIB008 BIB012 achieved near real-time classification by extracting features of only a fixed number of packets in a flow. They argue that the first packets carry enough information for classification. Using a higher number of packets increases accuracy, therefore it is possible to strike a balance between accuracy and early identification. The Data set columns describe whether the data used to evaluate the presented methods was taken from a live network (Real) or generated by a tool (Artificial). We also identify if the data sets were publicly available (Public), were made available by the authors (Published) or kept undisclosed as they contain sensitive information (Private). If more than one data set was used for each evaluation, we simply performed an union of the data set descriptions. The Ground truth column indicates how the ground truth was obtained for each data set. Common methods are based on port numbers or signatures, which use the packet payload. When the data sets are generated manually, the ground truth is known in advance. The classification accuracy reported by authors of the surveyed methods depends heavily on the data sets used. All authors use their own private data sets which are seldom published. Such methods simply cannot be compared without repeating the experiments on a common data set. The authors of BIB002 BIB006  BIB013 BIB010 BIB015 ] also used publicly available data sets which were either labelled beforehand, using payload when available, or simply labelled using port numbers. A combination of data sets is often used to test the robustness of the methods. The surveyed methods show that a lot of effort was put into classifying encrypted traffic. We believe that there are several points that should be taken into account in any future research in this field. First, identifying encrypted traffic is not enough. The identification of the underlying protocol is the real challenge. Second, a SSL/TLS protocol should be used as the reference protocol, as it can contain much more complex traffic than the SSH protocol. Finally, the traces used should be labelled and made available to other researchers. Following these points does not limit the scope of future research, however, it simplifies the comparison of the presented approaches and allows others to verify the results more easily. 