An empirical approach towards characterization of encrypted and unencrypted VoIP traffic

Choudhury, Paromita; Kumar, K. R. Prasanna; Nandi, Sukumar; Athithan, G.

doi:10.1007/s11042-019-08088-w

Cited by 17 publications

(20 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…5). Also, this and other similar approaches based on statistical randomness tests (e.g., [14,34]) cannot distinguish between different types of compressed archives. Mbol et al [32] investigate the use of the Kullback-Leibler divergence (relative entropy) to differentiate encrypted files from JPEG images.…”

Section: Non-entropy-based Approachesmentioning

confidence: 94%

“…The suite consists of 15 distinct tests, which analyze various structural aspects of a byte sequence. These tests are commonly employed as a benchmark for distinguishing compressed and encrypted content (e.g., [12,14]). Each test analyzes a particular property of the sequence, and subsequently applies a test-specific decision rule to determine whether the result of the analysis suggests randomness or not.…”

Section: Nist Sp800-22mentioning

confidence: 99%

“…In these settings, the metadata that is required by parsers is not present or is incomplete [35]. Given this issue, a number of works have been looking at alternative tests to distinguish between encrypted and compressed content [12,14,23,30,32,34,41]. While these works have the potential to be useful, there has been limited evaluation of their performance on a standardized dataset.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Gaspari

Hitaj

Pagnotta

et al. 2020

Network and System Security

View full text Add to dashboard Cite

Reliable identification of encrypted file fragments is a requirement for several security applications, including ransomware detection, digital forensics, and traffic analysis. A popular approach consists of estimating high entropy as a proxy for randomness. However, many modern content types (e.g. office documents, media files, etc.) are highly compressed for storage and transmission efficiency. Compression algorithms also output high-entropy data, thus reducing the accuracy of entropy-based encryption detectors.Over the years, a variety of approaches have been proposed to distinguish encrypted file fragments from high-entropy compressed fragments. However, these approaches are typically only evaluated over a few, selected data types and fragment sizes, which makes a fair assessment of their practical applicability impossible. This paper aims to close this gap by comparing existing statistical tests on a large, standardized dataset. Our results show that current approaches cannot reliably tell apart encryption and compression, even for large fragment sizes. To address this issue, we design EnCoD, a learning-based classifier which can reliably distinguish compressed and encrypted data, starting with fragments as small as 512 bytes. We evaluate EnCoD against current approaches over a large dataset of different data types, showing that it outperforms current state-of-the-art for most considered fragment sizes and data types.

show abstract

Section: Non-entropy-based Approachesmentioning

confidence: 94%

Section: Nist Sp800-22mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Gaspari

Hitaj

Pagnotta

et al. 2020

Network and System Security

View full text Add to dashboard Cite

show abstract

“…Estimating a random variable’s entropy is of great importance and with many applications, having received much attention in recent years [ 7 , 8 , 9 , 10 , 11 ]. Most of the known estimators are generally applied for the estimation of mutual information [ 12 ], but in this scenario entropy estimators will perform similarly, and thus the selection between different estimators is less of an issue.…”

Section: Introductionmentioning

confidence: 99%

Selecting an Effective Entropy Estimator for Short Sequences of Bits and Bytes with Maximum Entropy

Rodríguez

Madarro-Capó

Legón-Pérez

et al. 2021

Entropy

View full text Add to dashboard Cite

Entropy makes it possible to measure the uncertainty about an information source from the distribution of its output symbols. It is known that the maximum Shannon’s entropy of a discrete source of information is reached when its symbols follow a Uniform distribution. In cryptography, these sources have great applications since they allow for the highest security standards to be reached. In this work, the most effective estimator is selected to estimate entropy in short samples of bytes and bits with maximum entropy. For this, 18 estimators were compared. Results concerning the comparisons published in the literature between these estimators are discussed. The most suitable estimator is determined experimentally, based on its bias, the mean square error short samples of bytes and bits.

show abstract

“…Наличие сжатого или зашифрованного трафика в ситуации, для которой обычно используется только прозрачный трафик, может свидетельствовать, например, о работе сервера команд ботнета [1]. Сведения о шифровании данных внутри пакетов могут применяться для более точного определения протоколов и типов содержимого, что, в свою очередь, служит для повышения качества обслуживания, выделения приоритетного трафика [2] и анализа устройства и эффективности сети в целом. Эти данные могут использоваться как сами по себе, так и в качестве только одного из признаков в глобальной системе принятий решений.…”

Section: Introductionunclassified

Identification of transparent, compressed and encrypted data in network traffic

Getman¹,

Иконникова²

2021

Proceedings of ISP RAS

View full text Add to dashboard Cite

The article is dedicated to the problem of classifying network traffic into three categories: transparent, compressed and opaque, preferably in real-time. It begins with the description of the areas where this problem needs to be solved, then proceeds to the existing solutions with their methods, advantages and limitations. As most of the current research is done either in the area of separating traffic into transparent and opaque or into compressed and encrypted, the need arises to combine a subset of existing methods to unite these two problems into one. As later the main mathematical ideas and suggestions that lie behind the ideas used in the research done by other scientists are described, the list of the best performing of them is composed to be combined together and used as the features for the random forest classificator, which will divide the provided traffic into three classes. The best performing of these features are used, the optimal tree parameters are chosen and, what’s more, the initial three class classifier is divided into two sequential ones to save time needed for classifying in case of transparent packets. Then comes the proposition of the new method to classify the whole network flow as one into one of those three classes, the validity of which is confirmed on several examples of the protocols most specific in this area (SSH, SSL). The article concludes with the directions in which this research is to be continued, mostly optimizing it for real-time classification and obtaining more samples of traffic suitable for experiments and demonstrations.

show abstract

An empirical approach towards characterization of encrypted and unencrypted VoIP traffic

Cited by 17 publications

References 28 publications

EnCoD: Distinguishing Compressed and Encrypted File Fragments

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Selecting an Effective Entropy Estimator for Short Sequences of Bits and Bytes with Maximum Entropy

Identification of transparent, compressed and encrypted data in network traffic

Contact Info

Product

Resources

About