Are Neural Networks the Best Way for Encrypted Traffic Classification?

Shamsimukhametov, D.; Liubogoshchev, Mikhail; Khorov, Evgeny; Akyldiz, I.F.

doi:10.1109/ent50460.2021.9681767

Cited by 5 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of the ideas given by Shamsi et al [31] discusses the limitations of relying solely on neural networks (NNs) for classifying encrypted traffic, asserting that NNs alone cannot achieve 100% classification accuracy. This paper suggests that incorporating the Server Name Indication (SNI) field, which remains unencrypted during the TLS handshake and discloses the server's hostname, enhances classification algorithms.…”

Section: Advanced Machine Learning Techniques For Vpn Classificationmentioning

confidence: 99%

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

Alqahtany,

Syed

2024

Applied Sciences

View full text Add to dashboard Cite

In an era marked by technological advancement, the rising reliance on Virtual Private Networks (VPNs) necessitates sophisticated forensic analysis techniques to investigate VPN traffic, especially in mobile environments. This research introduces an innovative approach utilizing Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) for classifying VPN traffic, aiding forensic investigators in precisely identifying applications or websites accessed via VPN connections. By leveraging the combined strengths of CNNs and GNNs, our method provides an effective solution for discerning user activities during VPN sessions. Further extending this framework, we incorporate blockchain technology to meticulously record all mobile VPN transactions, ensuring a tamper-proof and transparent ledger that significantly bolsters the integrity and admissibility of forensic evidence in legal scenarios. A specific use-case demonstrates this methodology in mobile forensics, where our integrated approach not only accurately classifies data traffic but also securely logs transactional details on the blockchain, offering an unprecedented level of detail and reliability in forensic investigations. Extensive real-world VPN dataset experiments validate our approach, highlighting its potential to achieve high accuracy and offering invaluable insights for both technological and legal domains in the context of mobile VPN usage.

show abstract

Section: Advanced Machine Learning Techniques For Vpn Classificationmentioning

confidence: 99%

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

Alqahtany,

Syed

2024

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…However, many of these datasets are quite old and, thus, outdated. A dataset for encrypted network traffic classification of YouTube and Netflix is provided in [162]. Here, the authors collected three classes of flows, namely, web flows, YouTube flows, and Netflix flows for the most popular websites and videos, while using different end devices, browsers, and operating systems.…”

Section: ) (Encrypted) Network Traffic Analyticsmentioning

confidence: 99%

Machine Learning With Computer Networks: Techniques, Datasets, and Models

Afifi,

Pochaba,

Boltres

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…SNI-based classification fits well for QoS-aware TC because most of the services deploy isolated backend servers to generate traffic with the particular data types [4]. For example, servers with the primary domain "googlevideo.com" and "nflxvideo.net" are likely to carry video or audio content of YouTube and Netflix, respectively, while servers with the primary domain "ytimg.com" deliver YouTube thumbnail images [4], [35].…”

Section: ) Qos Provisioningmentioning

confidence: 99%

“…We do not consider packets different from those that carry CH and SH because they have been encrypted since TLS 1.3 and hardly improve the classification quality [4], [10]. We pick the third packet that commonly contains a Server Certificate message only to validate the baseline classifiers on the Open HTTPS dataset.…”

Section: ) Extraction Of the Key Information From Datasetsmentioning

confidence: 99%

“…SNI is the weak spot in privacy because it reveals a plain text domain name of the server [3]. As the largest content providers typically locate various types of media on different servers and name the servers accordingly [4], the middleboxes easily obtain the domain name, learn the type of data transmitted in a particular TCP or UDP connection and perform Traffic Classification (TC). For example, mobile operators use SNI to classify traffic of subscription services that do not count against the client tariff quota [5].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Is Encrypted ClientHello a Challenge for Traffic Classification?

et al. 2022

View full text Add to dashboard Cite

Although the widely-used Transport Layer Security (TLS) protocol hides application data, an unencrypted part of the TLS handshake, specifically the server name indication (SNI), is a backdoor for encrypted traffic classification frameworks. The recently developed Encrypted ClientHello (ECH) amendment to the TLS protocol aims to protect the privacy-sensitive content of the ClientHello message, including SNI. Conversely, ECH can be a game-changer in the early detection of encrypted traffic. The paper shows that the performance of the state-of-the-art traffic classification algorithms degrades significantly with the introduction of the ECH. Hence, novel approaches to real-time traffic classification are required. The paper develops two novel traffic classification algorithms to address this challenge. The first one uses unencrypted bytes of the TLS Hello messages as independent features of the Random Forest algorithm. It is extremely lightweight and suits throughput-focused traffic classification. It is faster than state-of-the-art algorithms by three times and achieves higher classification quality. The second algorithm augments the approach of the first one by focusing on the particular metadata of the handshake. This way, it efficiently extracts data from the exchange and achieves the highest classification quality in all the considered scenarios. It has a three times lower error rate than state-of-the-art algorithms and provides a reliable classification of ECH traffic.

show abstract

Are Neural Networks the Best Way for Encrypted Traffic Classification?

Cited by 5 publications

References 10 publications

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

Machine Learning With Computer Networks: Techniques, Datasets, and Models

Is Encrypted ClientHello a Challenge for Traffic Classification?

Contact Info

Product

Resources

About