Classification of Encrypted Internet Traffic Using Kullback-Leibler Divergence and Euclidean Distance

Cunha, Vanice Canuto; Zavala, Arturo Alejandro Zavala; Inácio, Pedro R. M.; Magoni, Damien; Freire, Mário M.

doi:10.1007/978-3-030-44041-1_77

Cited by 2 publications

(2 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [129] KL is employed to validate the not dissimilarity of unknown pixels. In [130], KL is used to classification of encrypted internet traffic.…”

Section: ) Jensen-shannon Divergencementioning

confidence: 99%

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

et al. 2022

View full text Add to dashboard Cite

Internet traffic classification aims to identify the kind of Internet traffic. With the rise of traffic encryption and multi-layer data encapsulation, some classic classification methods have lost their strength. In an attempt to increase classification performance, Machine Learning (ML) strategies have gained the scientific community interest and have shown themselves promising in the future of traffic classification, mainly in the recognition of encrypted traffic. However, some of these methods have a high computational resource consumption, which make them unfeasible for classification of large traffic flows or in real-time. Methods using statistical analysis have been used to classify real-time traffic or large traffic flows, where the main objective is to find statistical differences among flows or find a pattern in traffic characteristics through statistical properties that allow traffic classification. The purpose of this work is to address statistical methods to classify Internet traffic that were little or unexplored in the literature. This work is not generally focused on discussing statistical methodology. It focuses on discussing statistical tools applied to Internet traffic classification Thus, we provide an overview on statistical distances and divergences previously used or with potential to be used in the classification of Internet traffic. Then, we review previous works about Internet traffic classification using statistical methods, namely Euclidean, Bhattacharyya, and Hellinger distances, Jensen-Shannon and Kullback-Leibler (KL) divergences, Support Vector Machines (SVM), Correlation Information (Pearson Correlation), Kolmogorov-Smirnov and Chi-Square tests, and Entropy. We also discuss some open issues and future research directions on Internet traffic classification using statistical methods.

show abstract

“…In [129] KL is employed to validate the not dissimilarity of unknown pixels. In [130], KL is used to classification of encrypted internet traffic.…”

Section: ) Jensen-shannon Divergencementioning

confidence: 99%

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

et al. 2022

View full text Add to dashboard Cite

show abstract

“…In this research work, we use a dataset which was also described in a previously published work [28]. The data set contains approximately 25 GB of network traffic traces generated by different Internet applications and services, captured using the tcpdump tool and stored on disk.…”

Section: Dataset and Classification Featuresmentioning

confidence: 99%

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

Cunha

Magoni

Inácio

et al. 2022

Advanced Information Networking and Applications

Self Cite

View full text Add to dashboard Cite

Home users are increasingly acquiring, at lower prices, electronic devices such as video cameras, portable audio players, smartphones, and video game devices, which are all interconnected through the Internet. This increase in digital equipment ownership induces a massive production and sharing of multimedia content between these users. The supervised learning machine method Support Vector Machine (SVM) is vastly used in classification. It is capable of recognizing patterns of samples of predefined classes and supports multi-class classification. The purpose of this article is to explore the classification of multimedia P2P traffic using SVMs. To obtain relevant results, it is necessary to properly adjust the so-called Self C parameter. Our results show that SVM with linear kernel leads to the best classification results of P2P video with an F-Measure of 99% for C parameter ranging from 10 to 70 and to the best classification results of P2P file-sharing with an F-Measure of 98% for C parameter ranging from 30 to 70. We also compare these results with the ones obtained with Kolmogorov-Smirnov (KS) tests and Chi-square tests. It is shown that SVM with linear kernel leads to a better classification performance than KS and chi-square tests, which reached an F-Measure of 67% and 70% for P2P filesharing and P2P video, respectively, for KS test, and reached an F-Measure of 85% for both P2P file-sharing and P2P video for chi-square test. Therefore, SVM with linear kernel and suitable values for the Self C parameter can be a good choice for identifying encrypted multimedia P2P traffic on the Internet.

show abstract

Classification of Encrypted Internet Traffic Using Kullback-Leibler Divergence and Euclidean Distance

Cited by 2 publications

References 22 publications

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

Contact Info

Product

Resources

About