2020-boldyrikhin-classification-features-encrypted
canonical link → · doi: 10.18522/2311-3103-2020-3-89-98
findings extracted from this paper
The paper establishes that traffic classification relying on correlation with known patterns (rather than payload inspection) is viable for encrypted network traffic, motivating classifier designs that exploit the pulsating, random-process nature of traffic flows rather than decrypted content.
Encrypted traffic can be classified into audio, video, and data categories using only statistical features (traffic intensity curves, correlation patterns) without inspecting payload content. The paper demonstrates that indirect signs derived from packet-level statistics are sufficient to distinguish application types even when the payload is fully encrypted.
A correlation-based algorithm achieves sufficient accuracy for classifying encrypted audio and data traffic, but performs poorly on video traffic; an alternative algorithm based on differences in integral areas under traffic intensity curves is required for reliable video classification. This suggests video traffic exhibits distinct non-stationary statistical signatures not captured by simple correlation.