Real-time encrypted traffic classification with deep learning

With the widespread use of encryption, and VPN (Virtual Private Network) usage increase, traffic classification became difficult. It provides a way to take certain actions for specific traffic (e.g., different pricing, creating a safe internet for children) and utilize resources to be optimally used according to traffic. It engages the attention of internet providers, and governments. Apart from traditional methods: port-based, signature-based, and statistical; machine learning (ML), and deep learning also started to become popular. When encrypted, traffic can be harder to classify as packet content becomes unreadable. This study gains an advantage for encrypted traffic as it does not examine payload. Most of the work done used pre-collected packets, limits of real-time classification are not visible. This work aims to contribute to the shaping of these boundaries. Accuracy and packet processing time are on the radar. LSTM (Long Short-Term Memory) is a good candidate for this problem as it can handle sequences. Each flow can be modeled as a sequence. By adapting one of the studies in field, an ML model trained with statistical features is presented along with a new LSTM model. Compared to other LSTM studies, packets are not discarded if their flow is longer than the preset sequence length. Features are extracted from packet headers only. 14 labels are used to test the proposed solutions in total: non-VPN, VPN, 6 non-VPN categories, 6 VPN categories. Tests showed that LSTM is valid for traffic categorization in terms of accuracy and speed. Compared to the reference ML method, LSTM excelled with precision and recall differences up to 50 percent. The adapted algorithm is more accurate than the original. Accuracy with LSTM was measured as 97.77 percent offline and 91.7 in real-time. Packet processing time was recorded as 0.593 ms which is 5 times faster than another LSTM method. Flow-based ML has an accuracy of 99.83 percent, while packet-based has 99.99.