Classification of Messenger Network Traffic Using Machine Learning Methods

The article proposes an approach to using the machine learning method to analyze the structure of application network sessions. A number of experiments were carried out to classify messenger applications (for example, WhatsApp, Skype, Discord, Snapchat, Zoom and Zulip) in the network traffic flow. At the first stage, the distribution of byte values in the encrypted packet was checked. As a result, characteristic features were found in the data transmission of the considered applications. This made it possible to proceed to the second stage, in which machine learning methods based on frequency analysis were used to classify network traffic. The results obtained confirmed the possibility of building a classifier on a training set, which is a vector composed of network traffic. Also, work was carried out to find the optimal parameters to improve the performance of the classifier. For this, an approach was applied based on the analysis of byte values in certain places of the packets. As a result, classification reliability has been improved for all applications by more than 20%. The resulting classifiers made it possible to systematize application-level protocols in dumps of encrypted network traffic without using cryptanalysis methods and violating the confidentiality of transmitted data packets.