A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> FEATURE-BASED TRAFFIC CLASSIFICATION TECHNIQUES FOR ENCRYPTED TRAFFIC <s> Any assessment of classification techniques requires data. This document describes sets of data intended to aid in the assessment of classification work. A number of data sets are described; each data set consists a number of objects, and each object is described by a group of features (also referred to as discriminators). Leveraged by a quantity of hand-classified data, each object within each data set represents a single flow of TCP packets between client and server. The features for each object consist of the (application-centric) classification derived elsewhere and a number of features derived as input to probabilistic classification techniques. In addition to describing the features, we also provide information allowing interested parties to retrieve these data sets for use in their own work. The data sets contain no site-identifying information; each object is only described by a set of statistics and a class that defines the causal application. <s> BIB001 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> FEATURE-BASED TRAFFIC CLASSIFICATION TECHNIQUES FOR ENCRYPTED TRAFFIC <s> This chapter introduces the foundations of machine learning that are necessary to motivate its combination to evolutionary algorithms and image processing. In the chapter, we will describe several machine learning tools, suitable for a wide variety of data and tasks. The goal is not to describe the total number of techniques, but instead to present a general view of the field through the description of the mail problems considered in machine learning. <s> BIB002
This section surveys feature-based classification methods which specialize in encrypted traffic. These methods do not require any knowledge of the encryption protocol packet structure. Instead, they use specific protocol communication patterns to classify encrypted traffic. These methods are based on the specific protocol differences described in Section 2, such as packet and flow features of unencrypted initialization or the encrypted data transport phase. This approach provides greater generalization and allows these methods to work with new versions and types of encryption protocols without the modification of underlying algorithms. The taxonomy specified in Section 4 is used to describe the individual methods. Apart from the properties defined by the taxonomy, we also provide information about data sets used for evaluating these methods. This is especially important when additional evaluation is to be performed by other groups to verify the results of the authors. While the taxonomy provides a traffic class for classifying the application protocol, this is sometimes too coarse for our purposes. Most classification methods not only identify the encryption protocol, but also the underlying encrypted application protocol. As both cases belong to the application protocol traffic class, we provide further explanation in the description of each classification method. A slight drawback of flow-based classifiers is in performing classification often after the flow has expired. This prevents the possibility of a real-time response, which has led several research groups to research real-time classification using flow-features. Their methods are also included with the others in Table IV and differentiated by a column describing whether the classification is done in real-time or not. Almost 250 discriminators (flow or packet features) are identified by Moore et al. BIB001 , which can be used to classify flow records. The authors do not propose any specific classification method themselves, however, most of the classification algorithms use a subset of these discriminators for identifying traffic. In terms of the taxonomy, the authors provide a list of traffic features which are used to infer the category of the traffic's properties for the classification input. Most of the feature-based traffic classification methods use statistical or machine learning methods. These methods are comprehensively described in BIB002 . Port-based classification was used in the past to associate applications with network connections, but the accuracy of this method is decreasing with the increased use of dynamic ports and applications evading firewalls. Despite the decreased accuracy, port numbers are often utilized as one of the packet features. Furthermore, port-based classification is still quite often used to establish a ground truth for traffic classification experiments. For easier orientation, we present the surveyed papers grouped by the class of their traffic classification algorithm. Most of the papers employ Supervised Machine Learning Methods (Section 6.1), Semi-Supervised Machine Learning Methods (Section 6.2) and Basic Statistical Methods (Section 6.3). The rest combine more than one method and are therefore gathered in a Hybrid Methods category (Section 6.4). For each surveyed paper, we specify the classification technique, classification output, and the data sets used in the description of the classification process itself. Table IV in Section 6.5 provides a summary of the papers with all of the mentioned properties properly categorized.