Performance Comparison of Four Rule Sets: An Example for Encrypted Traffic Classification
Riyad Alshammari, Nur Zincir-Heywood, Abdel Aziz Farrag · 2009
The objective of this work is the classification of encrypted traffic where SSH is taken as an example application. To this end, four learning algorithms AdaBoost, RIPPER, C4.5 and Rough Set are evaluated using flow based features to extract the minimum features/rules set required to classify SSH traffic. Results indicate that C4.5 based classifier performs better than the other three. However, we have also identified 15 features that are important to classify encrypted traffic, namely SSH.