Integrating Machine Learning with Off-the-Shelf Traffic Flow Features for HTTP/HTTPS Traffic Classification
Ali Safari Khatouni, Nur Zincir-Heywood · 2019
Accurate traffic classification is a key requirement for different network and security monitoring/planning tools. The evolution of Internet protocols and applications has caused traditional traffic classification approaches to be ineffective in certain cases. Key causes of the inaccuracy include: (i) the increase in the encrypted traffic; (ii) the rise in the usage of dynamic port numbers for different applications; and (iii) multiple applications running over HTTP/HTTPS protocols. Traditional solutions for traffic analysis, classification, and measurement fall short in providing visibility in users' activities - a key requirement for network and security monitoring tools. In this paper, we evaluate an automatic classifier for encrypted Social media, Video and Audio traffic without relying on particular application layer header fields that can be easily modified. We leverage machine learning algorithms together with the features provided by the well-known off-the-shelf traffic flow exporters. We evaluate the performance of such a system also for generalization (robustness) purposes on different networks. Experimental results show promising performances in terms of generating robust traffic classification on large traffic data when the trained model is moved to different networks.