Characterization of Encrypted and VPN Traffic using Time-related Features

By G. Draper-Gil, Arash Habibi Lashkari, M. Mamun, Ali Akbar Ghorbani. International Conference on Information Systems Security and Privacy, 2016

1,188 citations recorded by the source corpus.

Traffic characterization is one of the major challenges in today’s security industry. The continuous evolution and generation of new applications and services, together with the expansion of encrypted communications makes it a difficult task. Virtual Private Networks (VPNs) are an example of encrypted communication service that is becoming popular, as method for bypassing censorship as well as accessing services that are geographically locked. In this paper, we study the effectiveness of flow-based time-related features to detect VPN traffic and to characterize encrypted traffic into different categories, according to the type of traffic e.g., browsing, streaming, etc. We use two different well-known machine learning techniques (C4.5 and KNN) to test the accuracy of our features. Our results show high accuracy and performance, confirming that time-related features are good classifiers for encrypted traffic characterization.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/28862175a0426761c4f41fdbbec5b244026c4010

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

InSDN: A Novel SDN Intrusion Dataset (2020, methodology): “In addition, the CICFlowMeter tool [65] is used to extract the flow”
Deep Learning for Intelligent Wireless Networks: A Comprehensive Survey (2018, methodology): “4% accuracy for application type classification, both outperforming the general ML-based schemes [95], [103].”
Large Language Model (LLM) for Telecommunications: A Comprehensive Survey on Principles, Key Techniques, and Opportunities (2024, background): “…across several encrypted traffic classification tasks, e.g., general encrypted application classification [132], encrypted malware classification, encrypted traffic classification on VPN [133], with the remarkable improvements over existing state-of-the-art methods by 5.4%, 0.2%, and 5.2%.”
Characterization of Tor Traffic using Time based Features (2017, methodology): “in (Draper-Gil et al., 2016), which includes the same applications on the same network.”
Toward Developing a Systematic Approach to Generate Benchmark Android Malware Datasets and Classification (2018, methodology): “Secondly, the paper extracts and calculates more than 80 network traffic features for all benign and malware Biflows by using CICFlowMeter software which is publicly available on Canadian Institute for Cybersecurity website [6].”
End-to-end encrypted traffic classification with one-dimensional convolution neural networks (2017, methodology): “Table VI, VII and VIII show the performance comparison on ISCX dataset between our proposed method and the state-of-the-art method in [3].”
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study (2020, methodology): “1) VPN-nonVPN dataset: [102] This dataset is proposed by Draper-Gil [103], which s captured a regular session and a session over virtual private network (VPN).”
Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges (2019, methodology): “Experiments, conducted on a selection of the “ISCX VPN-nonVPN” dataset [41], consist of four different setups: (i) VPN/nonVPN (binary) classification, (ii) encrypted TC (6 classes), (iii) TC of VPN-encapsulated data (6 classes), and (iv) encrypted TC (12 classes).”
ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022, methodology): “TotestET-BERTonserviceand application,wefurthercategorizethedatasetbyservicesandappli-cations,formingtheISCX-VPN-Servicedatasetwith12categories andtheISCX-VPN-Appdatasetwith17applications.”
Towards the Deployment of Machine Learning Solutions in Network Traffic Classification: A Systematic Survey (2019, neutral): “For instance, the works in [162]–[164] train ML classifiers with encrypted traffic data.”
Deep packet: a novel approach for encrypted traffic classification using deep learning (2017, methodology): “, [10] used time related features such as the duration of the flow, flow bytes per second, forward and backward inter-arrival time and etc.”