ANALYSIS OF ENCRYPTED NETWORK TRAFFIC BASED ON ENTROPY CALCULATION AND APPLICATION OF NEURAL NETWORK CLASSIFIERS

Abstract

Network traffic analysis allows you to solve many problems, such as: determining the pattern
of data transmission over the network, collecting statistics on the use of web applications,
monitoring and further researching network load, identifying potential malicious software and
network attacks, etc. 40% of Internet traffic belongs to unknown applications. This suggests that
for the area of network traffic analysis, the task of classifying applications has acquired particular
importance. Improvements in software in the field of network technologies have contributed to the
discovery of serious vulnerabilities in the implementation of some network protocols, namely TCP
and HTTP. By using network traffic analyzers, an attacker gained access to the contents of data
packets transmitted over the network. However, with the increasing qualifications of the information
community in the field of computer security, as well as with the development of network
technology standards, the analysis of network traffic has become noticeably more complicated.
The increased use of mathematical methods for protecting information, such as symmetric and
asymmetric cryptographic protocols, has led to the fact that most approaches to the analysis of
network traffic have lost their meaning and are no longer used. Therefore, the search for new
solutions to the problem of classifying network traffic, taking into account the possibility of its
encryption, is relevant. The article is devoted to the description of a new mixed approach to the
analysis of network traffic, based on the combined use of information theory and machine learning
algorithms. It also provides a comparative analysis of the proposed method with existing approaches
based on both information theory and machine learning. The aim of the research is to
develop an algorithm based on an intelligent approach to the analysis of network traffic. The proposed
algorithm is based on calculating entropy and using neural network classifiers. Research
objectives include: theoretical substantiation of the proposed approach in the field of information
theory, as well as machine learning algorithms; carrying out a structural description of the implemented
algorithms for calculating entropy and classifying applications that generate encrypted
traffic; comparative analysis of the proposed algorithm with existing approaches to the analysis of
encrypted network traffic. The result of the research is a new algorithm that allows classifying
various types of encrypted traffic with a high degree of reliability.