Detecting encrypted traffic: A machine learning approach

Seunghun Cha; Hyoungshick Kim

doi:10.1007/978-3-319-56549-1_5

Detecting encrypted traffic: A machine learning approach

Seunghun Cha
, Hyoungshick Kim

Department of Computer Science and Engineering

Sungkyunkwan University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

9 Scopus citations

Abstract

Detecting encrypted traffic is increasingly important for deep packet inspection (DPI) to improve the performance of intrusion detection systems. We propose a machine learning approach with several randomness tests to achieve high accuracy detection of encrypted traffic while requiring low overhead incurred by the detection procedure. To demonstrate how effective the proposed approach is, the performance of four classification methods (Naïve Bayesian, Support Vector Machine, CART and AdaBoost) are explored. Our recommendation is to use CART which is not only capable of achieving an accuracy of 99.9% but also up to about 2.9 times more efficient than the second best candidate (Naïve Bayesian).

Original language	English
Title of host publication	Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers
Editors	Dooho Choi, Sylvain Guilley
Publisher	Springer Verlag
Pages	54-65
Number of pages	12
ISBN (Print)	9783319565484
DOIs	https://doi.org/10.1007/978-3-319-56549-1_5
State	Published - 2017
Event	17th International Workshop on Information Security Applications, WISA 2016 - Jeju Island, Korea, Republic of Duration: 25 Aug 2016 → 25 Aug 2016

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10144 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	17th International Workshop on Information Security Applications, WISA 2016
Country/Territory	Korea, Republic of
City	Jeju Island
Period	25/08/16 → 25/08/16

Access to Document

10.1007/978-3-319-56549-1_5

Cite this

Cha, S., & Kim, H. (2017). Detecting encrypted traffic: A machine learning approach. In D. Choi, & S. Guilley (Eds.), Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers (pp. 54-65). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10144 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-319-56549-1_5

Cha, Seunghun ; Kim, Hyoungshick. / Detecting encrypted traffic : A machine learning approach. Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers. editor / Dooho Choi ; Sylvain Guilley . Springer Verlag, 2017. pp. 54-65 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{fb94baf561814e5693ac041ffa929019,

title = "Detecting encrypted traffic: A machine learning approach",

abstract = "Detecting encrypted traffic is increasingly important for deep packet inspection (DPI) to improve the performance of intrusion detection systems. We propose a machine learning approach with several randomness tests to achieve high accuracy detection of encrypted traffic while requiring low overhead incurred by the detection procedure. To demonstrate how effective the proposed approach is, the performance of four classification methods (Na{\"i}ve Bayesian, Support Vector Machine, CART and AdaBoost) are explored. Our recommendation is to use CART which is not only capable of achieving an accuracy of 99.9\% but also up to about 2.9 times more efficient than the second best candidate (Na{\"i}ve Bayesian).",

author = "Seunghun Cha and Hyoungshick Kim",

note = "Publisher Copyright: {\textcopyright} Springer International Publishing AG 2017.; 17th International Workshop on Information Security Applications, WISA 2016 ; Conference date: 25-08-2016 Through 25-08-2016",

year = "2017",

doi = "10.1007/978-3-319-56549-1\_5",

language = "English",

isbn = "9783319565484",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "54--65",

editor = "Dooho Choi and \{Guilley \}, Sylvain",

booktitle = "Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers",

}

Cha, S & Kim, H 2017, Detecting encrypted traffic: A machine learning approach. in D Choi & S Guilley (eds), Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10144 LNCS, Springer Verlag, pp. 54-65, 17th International Workshop on Information Security Applications, WISA 2016, Jeju Island, Korea, Republic of, 25/08/16. https://doi.org/10.1007/978-3-319-56549-1_5

Detecting encrypted traffic: A machine learning approach. / Cha, Seunghun; Kim, Hyoungshick.
Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers. ed. / Dooho Choi; Sylvain Guilley . Springer Verlag, 2017. p. 54-65 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10144 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Detecting encrypted traffic

T2 - 17th International Workshop on Information Security Applications, WISA 2016

AU - Cha, Seunghun

AU - Kim, Hyoungshick

PY - 2017

Y1 - 2017

N2 - Detecting encrypted traffic is increasingly important for deep packet inspection (DPI) to improve the performance of intrusion detection systems. We propose a machine learning approach with several randomness tests to achieve high accuracy detection of encrypted traffic while requiring low overhead incurred by the detection procedure. To demonstrate how effective the proposed approach is, the performance of four classification methods (Naïve Bayesian, Support Vector Machine, CART and AdaBoost) are explored. Our recommendation is to use CART which is not only capable of achieving an accuracy of 99.9% but also up to about 2.9 times more efficient than the second best candidate (Naïve Bayesian).

AB - Detecting encrypted traffic is increasingly important for deep packet inspection (DPI) to improve the performance of intrusion detection systems. We propose a machine learning approach with several randomness tests to achieve high accuracy detection of encrypted traffic while requiring low overhead incurred by the detection procedure. To demonstrate how effective the proposed approach is, the performance of four classification methods (Naïve Bayesian, Support Vector Machine, CART and AdaBoost) are explored. Our recommendation is to use CART which is not only capable of achieving an accuracy of 99.9% but also up to about 2.9 times more efficient than the second best candidate (Naïve Bayesian).

UR - https://www.scopus.com/pages/publications/85017639446

U2 - 10.1007/978-3-319-56549-1_5

DO - 10.1007/978-3-319-56549-1_5

M3 - Conference contribution

AN - SCOPUS:85017639446

SN - 9783319565484

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 54

EP - 65

BT - Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers

A2 - Choi, Dooho

A2 - Guilley , Sylvain

PB - Springer Verlag

Y2 - 25 August 2016 through 25 August 2016

ER -

Cha S, Kim H. Detecting encrypted traffic: A machine learning approach. In Choi D, Guilley S, editors, Information Security Applications - 17th International Workshop, WISA 2016, Revised Selected Papers. Springer Verlag. 2017. p. 54-65. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-56549-1_5

Detecting encrypted traffic: A machine learning approach

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this