Service Usage Classification with Encrypted Internet Traffic in Mobile Messaging Apps

2018 IEEE 32nd International Conference on Advanced Information Networking and Applications (AINA)

Korhonen

Andersson

et al. 2018

As end-to-end encryption on the Internet is becoming more prevalent, techniques such as deep packet inspection (DPI) can no longer be expected to be able to classify traffic. In many cellular networks a large fraction of all traffic is video traffic, and being able to divide flows in the network into video and non-video can provide considerable traffic engineering benefits. In this study we examine machine learning based flow classification using features that are available also for encrypted flows. Using a data set of several several billion packets from a live cellular network we examine the obtainable classification performance for two different ensemble-based classifiers. Further, we contrast the classification performance of a statistical-based feature set with a less computationally demanding alternate feature set. To also examine the runtime aspects of the problem, we export the trained models and use a tailor-made C implementation to evaluate the runtime performance. The results quantify the trade-off between classification and runtime performance, and show that up to 1 million classifications per second can be achieved for a single core. Considering that only the subset of flows reaching some minimum flow length will need to be classified, the results are promising with regards to deployment also in scenarios with very high flow arrival rates.

Section: Related Workmentioning

confidence: 99%

Towards Video Flow Classification at a Million Encrypted Flows Per Second

2018 IEEE 32nd International Conference on Advanced Information Networking and Applications (AINA)

Korhonen

Andersson

et al. 2018

“…Shbair et al [6] consider classification of encrypted traffic, and suggest a multi-level approach to identify application classes in HTTPS traffic. Fu et al [7] study encrypted cellular traffic, focusing in particular on how to classify mobile messaging apps. Correlating HTTPS traffic and DNS requests to allow host-based service classification of encrypted traffic is examined by Mori et al [8].…”

Section: Related Workmentioning

confidence: 99%

Clustering-based separation of media transfers in DPI-classified cellular video and VoIP traffic

2018 IEEE Wireless Communications and Networking Conference (WCNC)

Brunström

2018

Identifying VoIP and video traffic is often useful in the context of managing a cellular network, and to perform such traffic classification deep packet inspection (DPI) approaches are often used. Commercial DPI classifiers do not necessarily differentiate between, for example, YouTube traffic that arises from browsing inside the YouTube app, and traffic arising from the actual viewing of a YouTube video. Here we apply unsupervised clustering methods on such cellular DPI-labeled VoIP and video traffic to identify the characteristic behavior of the two subgroups of media-transfer and non media-transfer flows. The analysis is based on a measurement campaign performed inside the core network of a commercial cellular operator, collecting data for more than two billion packets in 40+ million flows. A specially instrumented commercial DPI appliance allows the simultaneous collection of per packet information in addition to the DPI classification output. We show that the majority of flows falls into clusters that are easily identifiable as belonging to one of the traffic subgroups , and that a surprising majority of DPIlabeled VoIP and video traffic is non-media related.

“…Here it can be observed that three of the clusters (2,3,6) appears to capture flows with characteristics consistent with transporting actual video data. The three remaining clusters (1,4,5) captures flows which are generated by video applications, but are unlikely to be transferring actual video data.…”

Section: Dbscan Clusteringmentioning

confidence: 99%

“…Regarding classifying encrypted traffic, Shbair et al [10] proposed a multi-level approach to identify application classes in HTTPS traffic. Fu et al [5] examines encrypted cellular traffic, with a particular interest in classifying mobile messaging apps. By analyzing a recent cellular data set we in this study extend the knowledge regarding video flow behavior as observable inside the core of the cellular network, with a focus on features also available for encrypted traffic.…”

Section: Introductionmentioning

confidence: 99%

A clustering-based analysis of DPI-labeled video flow characteristics in cellular networks

2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)

2017

A clustering-based analysis of DPI-labeled video flow characteristics in cellular Abstract-Using a specially instrumented deep packet inspection (DPI) appliance placed inside the core network of a commercial cellular operator we collect data from almost four million flows produced by a 'heavy-hitter' subset of the customer base. The data contains per packet information for the first 100 packets in each flow, along with the classification done by the DPI engine. The data is used with unsupervised learning to obtain clusters of typical video flow behaviors, with the intent to quantify the number of such clusters and examine their characteristics. Among the flows identified as belonging to video applications by the DPI engine, a subset are actually video application signaling flows or other flows not carrying actual transfers of video data. Given that DPI-labeled data can be used to train supervised machine learning models to identify flows carrying video transfers in encrypted traffic, the potential presence and structure of such 'noise' flows in the ground truth is important to examine. In this study K-means and DBSCAN is used to cluster the flows marked by the DPI engine as being from a video application. The clustering techniques identify a set of 4 to 6 clusters with archetypal flow behaviors, and a subset of these clusters are found to represent flows that are not actually transferring video data.