How Robust Can a Machine Learning Approach Be for Classifying Encrypted VoIP?

Abstract

The classification of encrypted network traffic represents an important issue for network management and security tasks including quality of service, firewall enforcement, and security. Traffic classification becomes more challenging since the traditional techniques, such as port numbers or Deep Packet Inspection, are ineffective against Peer-to-Peer Voice over Internet Protocol (VoIP) applications, which used non-standard ports and encryption. Moreover, traffic classification also represents a particularly challenging application domain for machine learning (ML). Solutions should ideally be both simple-therefore efficient to deploy-and accurate. Recent advances in ML provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain and increasing the throughput of solutions. In this work, we investigate the robustness of an ML approach to classify encrypted traffic on not only different network traffic but also against evasion attacks. Our ML based approach only employs statistical network traffic flow features without using the Internet Protocol addresses, source/destination ports, and payload information to unveil encrypted VoIP applications in network traffic. What we mean by robust signatures is that the signatures learned by training on one network are still valid when they are applied to traffic coming from totally different locations, networks, time periods, and also against evasion attacks. The results on different network traces, as well as on the evasion of a Skype classifier, demonstrate that the performance of the signatures are very promising, which implies that the statistical information based on the network layer with the use of ML can achieve high classification accuracy and produce robust signatures.

Using Burstiness for Network Applications Classification

“…Although the method showed acceptable performance (over 90%) [15] and it can detect the application type, it could not correctly identify the application names, classifying both Yahoo and Gmail as e-mail [16]. In contrast, high accuracy was achieved (over 95%) by applying the latter approach of statistical methods [17][18][19][20], using statistical features derived from the packet header, such as number of packets, packet size, interarrival packets time, and flow duration with the aid of machine learning algorithms. e advantage of using ML algorithms is that they can be used in real-time environments to provide rapid application detection with high accuracy.…”

Towards the Deployment of Machine Learning Solutions in Network Traffic Classification: A Systematic Survey

“…This characteristic makes them suitable for feature Some of them are computed under the assumption that the properties values are normally distributed, which might not be true for some cases. [110], [95], [96], [97], [111], [112], [113], [114], [115], [116], [117], [118], [119], [120], [121], [122], [123], [124], [125], [126], [127], [128], [129], [96], [130], [131], [132], [133], [134], [106], [135], [136], [137], [138], [105], [139], [140], [107], [141], [142], [143] Graph based features Internet interactions are modeled as graphs and valuable features can be extracted from these representations They are ideal for understanding communication patterns…”

“…VoIP communications have risen in popularity and their identification is a key factor in the telecommunication field either to prioritize or unable them. In consequence, several approaches have been proposed, such as the works in [160], [118], [114], [161], [128]. Some of these works tries to characterize and identify Skype, one of the most complex VoIP applications in the network due to its intricate communication protocol.…”

“…The performance is low compared to supervised approaches K-means [106], [140], [137], Hierarchical clustering [174]. [111], [7], [160], [118], [114], [161], [128], [159], [167], [168], [7], [164]. Naive Bayes [115], [166].…”

Methods and Techniques for Measurements in the Internet

“…It is straightforward to see that full payload packet-level trace would give the network analysts the most accurate information because the trace has virtually every bit of information that the sender-receiver pair exchanged. Please note that in the case of encrypted traffic, the payload itself will not be of any help, unless you either have the encryption key to decrypt its content or can use specific technique [15,16] to overcome this issue. On the other hand, the more aggregated the collected trace is, the less detailed information is.…”