Classification of encrypted internet traffic using machine learning approach

The rate of internet usage in the world is over 62% and this rate is increasing day by day. With this increase, it becomes important to ensure the confidentiality of the information in the traffic flowing over the internet. Encryption algorithms and protocols are used for this purpose. This situation, which is beneficial for normal users, is also used by attackers to hide. Cyber attackers or hackers gain the ability to bypass security precautions such as IDS/IPS and antivirus systems with using encrypted traffic. Since payload analysis cannot be performed without deciphering the encrypted traffic, existing commercial security solutions fall short in this situation. In this study, it is aimed to classify the network traffic by analysing the outgoing and incoming data over the encrypted traffic using Extreme Gradient Boosting (XGBoost), Decision Tree and Random Forest classification methods. In this way, it is possible to detect cyber attacks and take measures against attacks by increasing the analysis capabilities of network experts and cyber security experts on the network by classifying the encrypted traffic using only some metadata such as the size and duration of incoming and outgoing packets on the flowing traffic without deciphering. ISCX VPN-NonVPN dataset was used to test the proposed model in this study. With the created framework, encrypted traffic was classified with a high success rate and 94,53% success was achieved by using the XGBoost classification method.