Poster: Entropy and MinHash Fingerprints for Layer-7 Traffic Classification

This paper focuses on traffic classification by introducing fingerprints based on entropy and locality sensitive hashes. The proposed fingerprints capture the randomness in the requests and ensures that similar requests yield similar fingerprints. Fingerprinting involve i) extracting Layer-7 features from the traffic; ii) computing the n-grams of the extracted features and; iii) calculating the entropy and locality-sensitive hashed digests on the feature n-grams. The resulting fingerprints are used to classify traffic as either legitimate or suspicious traffic. An example classification using a Random Forest machine learning model demonstrates a 99% accuracy rate.