Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques

Abstract

Abstract. The identification of application flows is a critical task in order to manage bandwidth requirements of different kind of services (i.e. VOIP, Video, ERP). As network security functions spread, an increasing amount of traffic is natively encrypted due to privacy issues (e.g. VPN). This makes ineffective current traffic classification systems based on ports and payload inspection, e.g. even powerful Deep Packet Inspection is useless to classify application flow carried inside SSH sessions. We have developed a real time traffic classification method based on cluster analysis to identify SSH flows from statistical behavior of IP traffic parameters, such as length, arrival times and direction of packets. In this paper we describe our approach and relevant obtained results. We achieve detection rate up to 99.5 % in classifying SSH flows and accuracy up to 99.88 % for application flows carried within those flows, such as SCP, SFTP and HTTP over SSH.

Taking a Peek at Bandwidth Usage on Encrypted Links

“…These two classes represented the predominant traffic but with different percentages in training and testing sets, so they are the most difficult to recognize correctly. [13] or encrypted connections that carry a single TCP flow on top of it [14], [15], [16], [17], [18]. However, the informativeness of such features is not clear when considering protocols such as IPSec that multiplex the flows into the same encrypted connection, given that there is no way to reassembly the flows being routed through the IPSec channel without knowing the encryption keys.…”

Two-phased method for identifying SSH encrypted application flows

“…They also detected a decrease in accuracy when adding additional applications for detection. The present paper also utilizes K-means clustering algorithm, but the number of target applications is greater than in [8], including widely used BitTorrent protocol. It is noticeable that, with a greater number of tunneled application, the classification accuracy remains high.…”

“…al. [8] describe a real time K-means based identification algorithm for SSH encrypted application flows. They utilized arrival times, sizes and directions of packets in the classification.…”

“…Many of the recent studies [3], [7], [8], [12] use packet arrival times as a feature. This study does not use arrival times, because the network conditions can have a huge effect on packet inter-arrival times.…”

Peekaboo: A gray hole attack on encrypted SCADA communication using traffic analysis

“…A support vector machine was used in [13] to identify protocols other than HTTP and SSH tunneled over HTTP or SSH by looking at the message size, the block cipher size (involved in the message encryption), and the MTU size. Application-layer protocols sent through an encrypted tunnel that carries traffic from many TCP connections simultaneously were classified in [14], [15] using a k-NearestNeighbor classifier based on Hidden Markov Models with the message size, the message direction, and message inter-arrival times as features. In [16], the authors compared Bayesian Networks, Decision Trees and Multilayer Perceptrons for the flow-based classification of six different types of Internet traffic, including peer-to-peer and content delivery traffic, and showed the importance of correctly classifying training instances.…”