HEDGE: Efficient Traffic Classification of Encrypted and Compressed Packets

Casino, Fran; Choo, Kim‐Kwang Raymond; Patsakis, Constantinos

doi:10.1109/tifs.2019.2911156

Cited by 64 publications

(50 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In recent years, the research on encrypted traffic has mainly used feature engineering [8][9][10][11][12][13] to find out the characteristics that best reflect the features of different classes of encrypted traffic and then classify them by selecting an appropriate classifier. Currently, the commonly used classification models are mainly divided into three types: Markov models [14][15][16], traditional machine learning algorithms [17][18][19][20][21], and deep neural network methods [6,[22][23][24][25][26][27][28][29][30][31].…”

Section: Related Workmentioning

confidence: 99%

“…In 2018, Shi et al [12] proposed a new feature optimization method EFOA based on deep learning and feature selection technology, which can provide the best and robust features for traffic classification. In 2019, Casino et al [8] proposed HEDGE, a method to distinguish encrypted traffic from compressed traffic, using three features based on randomness tests as thresholds for distinguishing highentropy files.…”

Section: Related Workmentioning

confidence: 99%

“…Input P j+1 after P j to the CLD-Net model; ( 6) else (7) Add P 0 between P j and P j+1 and input them to the CLD-Net model in turn; (8) end if (9) end for; (10) end for; Security and Communication Networks e left part of Figure 2 is a CNN, which contains 10 four-layer 1D-CNN. For each CNN, the input is a 5 × 256-dimension matrix, where 5 is the number of channels.…”

Section: Cld-net Modelmentioning

confidence: 99%

“…raw network traffic dataset D; number of traffic classes C; Output: packet matrix P;(1) for each i ∈ [1, C] do (2)Randomly select N consecutive 10 packets in D; (3) 10 consecutive packets consist a flow F, that is, the number of F is N;(4) Randomly divide the F into a training set F train and a testing set F test in proportion; // Traffic split;(5) for each j ∈ [1, N] do(6) for each packet p ∈ F do(7) Trim p and uniform length of 256 bytes, p ⟶ payload p 256 ; // Traffic clean;(8) Recombine p 256 ⟶ p α ; // Traffic recombination;(9) Generate the grayscale image format to get the packet matrix, p α ⟶ P; // Traffic conversion;…”

mentioning

confidence: 99%

See 3 more Smart Citations

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Wei

2021

Security and Communication Networks

View full text Add to dashboard Cite

The development of the Internet has led to the complexity of network encrypted traffic. Identifying the specific classes of network encryption traffic is an important part of maintaining information security. The traditional traffic classification based on machine learning largely requires expert experience. As an end-to-end model, deep neural networks can minimize human intervention. This paper proposes the CLD-Net model, which can effectively distinguish network encrypted traffic. By segmenting and recombining the packet payload of the raw flow, it can automatically extract the features related to the packet payload, and by changing the expression of the packet interval, it integrates the packet interval information into the model. We use the ability of Convolutional Neural Network (CNN) to distinguish image classes, learn and classify the grayscale images that the raw flow has been preprocessed into, and then use the effectiveness of Long Short-Term Memory (LSTM) network on time series data to further enhance the model’s ability to classify. Finally, through feature reduction, the high-dimensional features learned by the neural network are converted into 8 dimensions to distinguish 8 different classes of network encrypted traffic. In order to verify the effectiveness of the CLD-Net model, we use the ISCX public dataset to conduct experiments. The results show that our proposed model can distinguish whether the unknown network traffic uses Virtual Private Network (VPN) with an accuracy of 98% and can accurately identify the specific traffic (chats, audio, or file) of Facebook and Skype applications with an accuracy of 92.89%.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Cld-net Modelmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

Wei

2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…FIPS 140-2 and ent both trivially identify JPEG images, but an alarming amount of WEBP images (at least for file sizes less than 101KB) are reported as random by both these methods. While there are statistical means to distinguish encrypted from compressed data [30], it is yet to be seen whether with a larger amount of data and more sophisticated tests WEBP will be detected as non-random. The ability to embed meaningful, visuallyrich information in a random stream cannot be understated; if undetected this could be used as a means of data exfiltration.…”

Section: Discussionmentioning

confidence: 99%

On the Unbearable Lightness of FIPS 140–2 Randomness Tests

Hurley-Smith

Patsakis

Hernández-Castro

2022

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

Random number generation is critical to many applications. Gaming, gambling, and particularly cryptography all require random numbers that are uniform and unpredictable. For testing whether supposedly random sources feature particular characteristics commonly found in random sequences, batteries of statistical tests are used. These are fundamental tools in the evaluation of random number generators and form part of the pathway to certification of secure systems implementing them. Although there have been previous studies into this subject [1], RNG manufacturers and vendors continue to use statistical tests known to be of dubious reliability, in their RNG verification processes. Our research shows that FIPS-140-2 cannot identify adversarial biases effectively, even very primitive ones. Concretely, this work illustrates the inability of the FIPS 140 family of tests to detect bias in three obviously flawed PRNGs. Deprecated by official standards, these tests are nevertheless still widely used, for example in hardware-level self-test schemes incorporated into the design of many True RNGs (TRNGs). They are also popular with engineers and cryptographers for quickly assessing the randomness characteristics of security primitives and protocols, and even with manufacturers aiming to market the randomness features of their products to potential customers. In the following, we present three biased-by-design RNGs to show in explicit detail how simple, glaringly obvious biases are not detected by any of the FIPS 140-2 tests. One of these RNGs is backdoored, leaking key material, while others suffer from significantly reduced unpredictability in their output sequences. To make our point even more straightforward, we show how files containing images can also fool the FIPS 140 family of tests. We end with a discussion on the security issues affecting an interesting and active project to create a randomness beacon. Their authors only tested the quality of their randomness with the FIPS 140 family of tests, and we will show how this has led them to produce predictable output that, albeit passing FIPS fails other randomness tests quite catastrophically.

show abstract

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Gaspari

Hitaj

Pagnotta

et al. 2020

Network and System Security

View full text Add to dashboard Cite

Reliable identification of encrypted file fragments is a requirement for several security applications, including ransomware detection, digital forensics, and traffic analysis. A popular approach consists of estimating high entropy as a proxy for randomness. However, many modern content types (e.g. office documents, media files, etc.) are highly compressed for storage and transmission efficiency. Compression algorithms also output high-entropy data, thus reducing the accuracy of entropy-based encryption detectors.Over the years, a variety of approaches have been proposed to distinguish encrypted file fragments from high-entropy compressed fragments. However, these approaches are typically only evaluated over a few, selected data types and fragment sizes, which makes a fair assessment of their practical applicability impossible. This paper aims to close this gap by comparing existing statistical tests on a large, standardized dataset. Our results show that current approaches cannot reliably tell apart encryption and compression, even for large fragment sizes. To address this issue, we design EnCoD, a learning-based classifier which can reliably distinguish compressed and encrypted data, starting with fragments as small as 512 bytes. We evaluate EnCoD against current approaches over a large dataset of different data types, showing that it outperforms current state-of-the-art for most considered fragment sizes and data types.

show abstract

HEDGE: Efficient Traffic Classification of Encrypted and Compressed Packets

Cited by 64 publications

References 47 publications

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

CLD-Net: A Network Combining CNN and LSTM for Internet Encrypted Traffic Classification

On the Unbearable Lightness of FIPS 140–2 Randomness Tests

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Contact Info

Product

Resources

About