CLASSIFICATION FEATURES OF ENCRYPTED NETWORK TRAFFIC

Abstract

Currently, there is growing interest in the tasks of efficient packet network management:
quality of service, ensuring information security, optimization of the network hardware and software
resources. All these tasks rely heavily on the analysis and classification of network traffic.
This traffic is heterogeneous, as a rule, has a pulsating nature, difficult to predict and described by
the mathematical apparatus of random processes. At different times, the conditions for passingpackets along the same path can vary significantly. At the same time, a significant number of applications
are appearing requiring latency and jitter. The administration task in this context is to
correctly configure the switching and routing nodes. Traffic classification allows you to identify
packages of various applications and services and ensure their prioritization during transmission
over the network. For example, video conferencing traffic needs to be transmitted first of all, since
it is very sensitive to delays and jitter, data traffic can be transmitted last. The classification of
traffic today is an urgent task both in terms of network administration and in terms of ensuring its
security. Due to the fact that a large number of applications now encrypt the transmitted information
and it is very difficult to view its contents, the traffic classification is of particular interest,
which allows indirect signs to determine anomalies in the network, signs of intrusion. In this paper,
we consider the features of solving the classification problem of encrypted traffic. The aim of
the work is to study the classification features of encrypted traffic using correlation analysis and
an algorithm based on the difference in integral areas. Research Objectives: – develop a traffic
classification algorithm based on correlation and known patterns; – develop an algorithm based
on the difference of the integral areas under the traffic intensity curves; – conduct a practical
study of the accuracy of solving the classification problem. The work considers the classification
of traffic into three groups: audio, video, data. As a result, a sufficient accuracy of the correlation
algorithm in determining audio and data traffic was revealed. To identify video traffic, it is better
to use an algorithm based on the difference of the integral areas under the intensity curves.