Realtime classification for encrypted traffic

  • Authors:
  • Roni Bar - Yanai;Michael Langberg;David Peleg;Liam Roditty

  • Affiliations:
  • Cisco, Netanya, Israel;Computer Science Division, Open University of Israel, Raanana, Israel;Department of Computer Science, Weizmann Institute of Science, Rehovot, Israel;Department of Computer Science, Bar-Ilan University, Ramat-Gan, Israel

  • Venue:
  • SEA'10 Proceedings of the 9th international conference on Experimental Algorithms
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Classifying network flows by their application type is the backbone of many crucial network monitoring and controlling tasks, including billing, quality of service, security and trend analyzers. The classical “port-based” and “payload-based” approaches to traffic classification have several shortcomings. These limitations have motivated the study of classification techniques that build on the foundations of learning theory and statistics. The current paper presents a new statistical classifier that allows real time classification of encrypted data. Our method is based on a hybrid combination of the k-means and k-nearest neighbor (or k-NN) geometrical classifiers. The proposed classifier is both fast and accurate, as implied by our feasibility tests, which included implementing and intergrading statistical classification into a realtime embedded environment. The experimental results indicate that our classifier is extremely robust to encryption.