Payload based multi-phase traffic classification with majority voting

Internet is becoming an essential part of our lives with even simple daily tasks depending on it. This led to an increase in network traffic accompanied with increase in number of applications hosted on internet. In this heavy traffic environment, classifying network flows in a fast and accurate manner, has great importance for network management. Internet Service Providers try to address this issue by using different approaches from port-based methods to machine learning models but due to widespread usage of dynamic ports and encrypted packets by modern applications, accuracy of these approaches declined. To overcome this challenge, recent studies focus on solutions using deep learning architectures. In this thesis, a multi-phase classification model based on voting and deep learning is proposed for encrypted traffic classification. The proposed model relies on the payload of the transmitted packets to classify flows. In this approach, deep learning based classifiers are trained using different numbers of packets from flows as input and the prediction of multi-phase model is an ensemble of these classifiers calculated by different voting strategies. This approach enables classification of flows starting from the first transmitted packet with payload, and updates the predicted class as the number of transmitted packets in flow increases. This approach has been tested on datasets containing real network flows from various applications. The performance of proposed approach is evaluated by comparing different classification models and different voting strategies.