Encrypted traffic classification based on Gaussian mixture models and Hidden Markov Models. (15th September 2020)

• Record Type: Journal Article
• Authors: Yao, Zhongjiang; Ge, Jingguo; Wu, Yulei; Lin, Xiaosheng; He, Runkang; Ma, Yuxiang
• Is Part Of: Journal of network and computer applications. Volume 166(2020)
• Publication Date: 2020-09-15
• Subjects: Traffic classification -- Encrypted traffic -- Gaussian mixture model -- Hidden Markov model; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2020.102711
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: To protect user privacy (e.g., IP address and sensitive data in a packet), many traffic protection methods, like traffic obfuscation and encryption technologies, are introduced. However, these methods have been used by attackers to transmit malicious traffic, posing a serious threat to network security. To enhance network traffic supervision, this paper proposes a new traffic classification model based on Gaussian mixture models and hidden Markov models, named MGHMM. To evaluate the effectiveness of the proposed model, we first classify protocols and identify the obfuscated traffic by experiments. Then, we compare the classification performance of MGHMM with that of the latest Vector Quantiser-based traffic classification algorithm. On the basis of the experiment, the relation between the classification and the number of hidden Markov states, and the number of mixture of Gaussian distributions required to describe the hidden states, are analyzed. Highlights: Only need inter-packet time and packet size for traffic classification. Analyze the discrete distribution and timing pattern of the flow features. Perform well in traffic classification at multiple traffic levels. Obtain the best classification results with minimal resource overhead.