NDLI: A Comparison of three machine learning techniques for encrypted network traffic analysis

Content Provider	IEEE Xplore Digital Library
Author	Arndt, D.J. Zincir-Heywood, A.N.
Copyright Year	2011
Description	Author affiliation: Faculty of Computer Science, Dalhousie University, Halifax, Nova Scotia, Canada (Arndt, D.J.; Zincir-Heywood, A.N.)
Abstract	This work evaluates three methods for encrypted traffic analysis without using the IP addresses, port number, and payload information. To this end, binary identification of SSH vs non-SSH traffic is used as a case study since the plain text initiation of the SSH protocol allows us to obtain data sets with a reliable ground truth. The methods are subject to several tests using different export options, feature sets, and training and test traffic traces for a total of 128 different configurations. Of particular interest are test cases which that use a test set from a different network than that which the model was trained on, i.e. robustness of the trained models. Results show that the multi-objective genetic algorithm (MOGA) based trained model is able to achieve the best performance among the three methods when each approach is tested on traffic traces that are captured on the same network as the training network trace. On the other hand, C4.5 achieved the best results among the three methods when tested on traffic traces which are captured on totally different networks than the training trace. Furthermore, it is shown that continuous sampling of the training data is no better than random sampling, but the training data is very important for how well the classifiers will perform on traffic traces captured from different networks. Moreover, the C4.5 based approach provides the fastest and the most human readable model, whereas the MOGA reduces the complexity of the k-means clustering algorithm tremendously.
Starting Page	107
Ending Page	114
File Size	1537490
Page Count	8
File Format	PDF
ISBN	9781424499397
e-ISBN	9781424499410
DOI	10.1109/CISDA.2011.5945941
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-04-11
Publisher Place	France
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Training Protocols Clustering algorithms Robustness Mathematical model Equations Payloads
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

A Comparison of Three Machine Learning Techniques for Encrypted Network Traffic Analysis

A novel semi-supervised approach for network traffic clustering

Genetic optimization and hierarchical clustering applied to encrypted traffic identification

An analysis of clustering objectives for feature selection applied to encrypted traffic identification

Investigating Two Different Approaches for Encrypted Traffic Classification

A multiple-stage classifier for identifying unknown Internet traffic

Internet traffic clustering with constraints

A framework for tunneled traffic analysis

Online automatic traffic classification architecture in access network

A Comparison of three machine learning techniques for encrypted network traffic analysis

Similar Documents

A Comparison of Three Machine Learning Techniques for Encrypted Network Traffic Analysis

A novel semi-supervised approach for network traffic clustering

Genetic optimization and hierarchical clustering applied to encrypted traffic identification

An analysis of clustering objectives for feature selection applied to encrypted traffic identification

Investigating Two Different Approaches for Encrypted Traffic Classification

A multiple-stage classifier for identifying unknown Internet traffic

Internet traffic clustering with constraints

A framework for tunneled traffic analysis

Online automatic traffic classification architecture in access network

A Comparison of three machine learning techniques for encrypted network traffic analysis