Encrypted Web Traffic Classification

Traffic analysis is very much essential in many network monitoring/surveillance and middle box appliances installed at the perimeter of the internal and the external network. Internet Service Providers are also required to do traffic analysis for the purpose of providing the Quality of Service (QoS) parameters as mentioned in the Service Level Agreement. A lot of research is being done in the field of traffic analysis based on the machine learning (ML) based approaches. The main factor in ML based approaches is the selection of the features which can uniquely determine and thus classify the traffic flows. In this paper, website fingerprinting (WF) for a particular browser and WF for different browsers has been carried out. The analysis is carried out on encrypted traffic flows, i.e., those using Secure Socket layer/Transport Layer Security (SSL/TLS). The feature extraction phase includes a feature set which are uncorrelated and combines the statistical parameters of a traffic flow as well as information extracted from the meta-data of the encrypted traffic flows. The feature extraction phase is thus the critical step in the later classification strategy for WF. The classification involves machine learning algorithms and for that we have utilized a machine learning tool to automate the process. After training the classifier, the testing and validating shows that the features used for the classification process are indeed very useful in distinguishing the various encrypted web traffic flows captured from visiting various websites and also through the use of different browsers.