Using support vector machine in traffic analysis for Website recognition

Website recognition is the process of identifying specific Websites from analyzing the traffic flow. Encryption invalidates content analysis techniques, while traffic analysis can solve the problem by concentrating on the nature and behavior of traffic. Based on the structural-stable but content-mutable properties of Website, a method combining machine learning algorithm and traffic analysis technique is proposed for encrypted Website recognition. Session describing vector, composed of connection count and data volumes transferred in each connection, is introduced to characterize a Web surfing flow, and through vector normalization, generalization and ranking, the sequence, length and dimension weight are adjusted to improve the recognition effect. The recognition process can be considered as a binary classification problem, thus SVM (support vector machine) algorithm is adopted because of its excellent performance in pattern classification problems. Experiments show that the proposed method can discern the vectors of a specific Website from others clearly, and the process of generalization and ranking are of great help to classification.