Using DPI and Statistical Analysis in Encrypted Network Traffic Monitoring
Luca Deri, Daniele Sartiano · International Journal for Information Security Research · 2020
The pervasive use of encrypted protocols and new communication paradigms based on mobile and home IoT devices has obsoleted traffic analysis techniques that relied on clear text analysis.This has required new monitoring metrics being able to characterise, identify, and classify traffic not just in terms of network protocols but also behaviour and intended use.This paper reports the lessons learnt while analysing traffic in both home networks and the Internet, and it describes how monitoring metrics used in experiments have been implemented on an open source toolkit for deep packet inspection (DPI) and traffic analysis developed by the authors.The validation process confirmed that combining the proposed metrics with DPI, it is possible to effectively characterise and fingerprint encrypted traffic generated by home IoT and non-IoT devices, paving the way to next generation DPI toolkit development.