QUIC SNI decryption usefulness prediction using Machine Learning

A Deep Packet Inspection (DPI) system detects application traffic flow by examining packet payload. Many streaming platforms have started using Quick UDP Internet Connections (QUIC) protocol for streaming the content. QUIC supports encrypted Server Name Indication (SNI) in Client Hello packet, which is generally used by DPI systems to detect the flow. The pseudo-encrypted SNI can be decrypted by middle-boxes but it is a costly operation. With higher amount of QUIC traffic, costly decryption task can limit throughput of DPI systems. With the help of Machine learning (ML) algorithms, including Reinforcement learning, we intelligently predict if decrypting given QUIC packet’s SNI would be useful or not in terms of final detection for given DPI solution. We go for SNI decryption only in case it is predicted as useful – thus avoiding decryption for many QUIC flows which would not get detected as application flow. Our test results show around 96-98% accurate prediction with various ML models. With proposed solution, DPI system throughput can be greatly enhanced to cater to higher data rates.