The DOI matches its Crossref record; 50 of the 50 references it cites were found in a registry or an index.
A survey of methods for encrypted traffic classification and analysis
Open accessAbstract
Summary: With the widespread use of encrypted data transport, network traffic encryption is becoming a standard nowadays. This presents a challenge for traffic measurement, especially for analysis and anomaly detection methods, which are dependent on the type of network traffic. In this paper, we survey existing approaches for classification and analysis of encrypted traffic. First, we describe the most widespread encryption protocols used throughout the Internet. We show that the initiation of an encrypted connection and the protocol structure give away much information for encrypted traffic classification and analysis. Then, we survey payload and feature‐based classification methods for encrypted traffic and categorize them using an established taxonomy. The advantage of some of described classification methods is the ability to recognize the encrypted application protocol in addition to the encryption protocol. Finally, we make a comprehensive comparison of the surveyed feature‐based classification methods and present their weaknesses and strengths. Copyright © 2015 John Wiley & Sons, Ltd.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Transport Layer Security (TLS) Protocol Version 1.1
Dierks, T., & Rescorla, E. (2006) · doi:10.17487/rfc4346 · Cited by 2,278
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664
Introduction to Machine Learning
(2019) · Series in Machine Perception and Artificial Intelligence · doi:10.1142/9789811201967_0001 · Cited by 1,639
The Transport Layer Security (TLS) Protocol Version 1.2
Dierks, T., & Rescorla, E. (2008) · doi:10.17487/rfc5246 · Cited by 1,576
Introduction to Machine Learning
(2010) · Kybernetes · doi:10.1108/k.2010.06739hae.001 · Cited by 1,183
IP Encapsulating Security Payload (ESP)
Atkinson, R. (1995) · doi:10.17487/rfc1827 · Cited by 1,076
Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., & Polk, W. (2008) · doi:10.17487/rfc5280 · Cited by 1,075
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1080091.1080119 · Cited by 997
Rahbar, A. G. P., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668
Issues and future directions in traffic classification
Dainotti, A., Pescape, A., & Claffy, K. (2012) · IEEE Network · doi:10.1109/mnet.2012.6135854 · Cited by 630
IP Encapsulating Security Payload (ESP)
Kent, S. (2005) · doi:10.17487/rfc4303 · Cited by 435
Discriminators for use in flow-based classification
Moore, A. W., Zuev, D. V., & Crogan, M. (2013) · Cited by 396
A Survey on Internet Traffic Identification
Callado, A., Kamienski, C., Szabo, G., Gero, B. P., Kelner, J., Fernandes, S., & Sadok, D. (2009) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2009.090304 · Cited by 378
The Secure Sockets Layer (SSL) Protocol Version 3.0
Freier, A., Karlton, P., & Kocher, P. (2011) · doi:10.17487/rfc6101 · Cited by 358
Internet Key Exchange Protocol Version 2 (IKEv2)
Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., & Kivinen, T. (2014) · doi:10.17487/rfc7296 · Cited by 340
A Survey of Payload-Based Traffic Classification Approaches
Finsterbusch, M., Richter, C., Rocha, E., Muller, J.-A., & Hanssgen, K. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.100613.00161 · Cited by 325
The Secure Shell (SSH) Transport Layer Protocol
Ylonen, T. (2006) · doi:10.17487/rfc4253 · Cited by 292
Analysis of the HTTPS certificate ecosystem
Durumeric, Z., Kasten, J., Bailey, M., & Halderman, J. A. (2013) · Proceedings of the 2013 conference on Internet measurement conference · doi:10.1145/2504730.2504755 · Cited by 286
Independent comparison of popular DPI tools for traffic classification
Bujlow, T., Carela-Español, V., & Barlet-Ros, P. (2015) · Computer Networks · doi:10.1016/j.comnet.2014.11.001 · Cited by 245
On Inferring Application Protocol Behaviors in Encrypted Network Traffic
Wright, C. V., Monrose, F., Masson, G. M., & Chan, P. (2006) · Cited by 222
nDPI: Open-source high-speed deep packet inspection
Deri, L., Martinelli, M., Bujlow, T., & Cardigliano, A. (2014) · 2014 International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2014.6906427 · Cited by 206
Machine learning based encrypted traffic classification: Identifying SSH and Skype
Alshammari, R., & Zincir-Heywood, A. N. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356534 · Cited by 202 · cited 2×
“Another very popular protocol for identification is Skype, which is addressed by the authors of [51,53,64,66].”
BackgroundMethodEarly Recognition of Encrypted Applications
Bernaille, L., & Teixeira, R. (2007) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-71617-4_17 · Cited by 196
Markov chain fingerprinting to classify encrypted traffic
Korczynski, M., & Duda, A. (2014) · IEEE INFOCOM 2014 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2014.6848005 · Cited by 192
The SSL landscape: a thorough analysis of the x.509 PKI using active and passive measurements
Holz, R., Braun, L., Kammenhuber, N., & Carle, G. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068856 · Cited by 191
Internet Key Exchange Protocol Version 2 (IKEv2)
Kaufman, C., Hoffman, P., Nir, Y., & Eronen, P. (2010) · doi:10.17487/rfc5996 · Cited by 160
Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?
Alshammari, R., & Zincir-Heywood, N. (2010) · Computer Networks · doi:10.1016/j.comnet.2010.12.002 · Cited by 157
Realtime Classification for Encrypted Traffic
Yanai, R. B. , Langberg, M., Peleg, D., & Roditty, L. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13193-6_32 · Cited by 107
I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis
Miller, B., Huang, L., Joseph, A. D., & Tygar, J. D. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-08506-7_8 · Cited by 99
A Survey on Encrypted Traffic Classification
Cao, Z., Xiong, G., Zhao, Y. T., Li, Z., & Guo, L. (2014) · Communications in computer and information science · doi:10.1007/978-3-662-45670-5_8 · Cited by 96
Frankel, S. E., Kent, K., Lewkowski, R., Orebaugh, A., Ritchey, R. W., & Sharma, S. R. (2005) · doi:10.6028/nist.sp.800-77 · Cited by 85
An Novel Hybrid Method for Effectively Classifying Encrypted Traffic
Sun, G., Xue, Y., Dong, Y., Wang, D., & Li, C. (2010) · Globecom · doi:10.1109/glocom.2010.5683649 · Cited by 73
A flow based approach for SSH traffic detection
Alshammari, R., & Zincir-Heywood, N. (2007) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/icsmc.2007.4414006 · Cited by 63
A multilevel taxonomy and requirements for an optimal traffic‐classification model
Khalife, J., Hajjar, A. F., & Dı́az-Verdejo, J. E. (2014) · International Journal of Network Management · doi:10.1002/nem.1855 · Cited by 58
A Comparison of three machine learning techniques for encrypted network traffic analysis
Arndt, D. J., & Zincir-Heywood, N. (2011) · IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) · doi:10.1109/cisda.2011.5945941 · Cited by 57
Skype‐Hunter: A real‐time system for the detection and classification of Skype traffic
Adami, D., Callegari, C., Giordano, S., Pagano, M., & Pepe, T. (2011) · International Journal of Communication Systems · doi:10.1002/dac.1247 · Cited by 45
Towards real-time processing for application identification of encrypted traffic
Kumano, Y., Ata, S., Nakamura, N., Nakahira, Y., & Oka, I. (2014) · 2012 International Conference on Computing, Networking and Communications (ICNC) · doi:10.1109/iccnc.2014.6785319 · Cited by 44
An investigation on the identification of VoIP traffic: Case study on Gtalk and Skype
Alshammari, R., & Zincir-Heywood, N. (2010) · International Conference on Network and Service Management (CNSM) · doi:10.1109/cnsm.2010.5691210 · Cited by 42
State of the Art in Traffic Classification: A Research Review
Zhang, M., John, W., claffy, K., & Brownlee, N. (2009) · Cited by 38
An Experimental Study of TLS Forward Secrecy Deployments
Huang, L.-S., Adhikarla, S., Boneh, D., & Jackson, C. (2014) · IEEE Internet Computing · doi:10.1109/mic.2014.86 · Cited by 36
An Information-Theoretical Approach to High-Speed Flow Nature Identification
Khakpour, A. R., & Liu, A. X. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2219591 · Cited by 34
Classifying service flows in the encrypted skype traffic
Korczyński, M., & Duda, A. (2012) · International Conference on Communications · doi:10.1109/icc.2012.6364024 · Cited by 32
Genetic optimization and hierarchical clustering applied to encrypted traffic identification
Bacquet, C., Zincir-Heywood, N., & Heywood, M. I. (2011) · IEEE Symposium on Computational Intelligence in Cyber Security (CICS) · doi:10.1109/cicybs.2011.5949391 · Cited by 31
Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques
Maiolini, G., Baiocchi, A., Iacovazzi, A., & Rizzi, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01399-7_15 · Cited by 29
Encrypted Traffic Classification Based on an Improved Clustering Algorithm
Zhang, M., Zhang, H., Zhang, B., & Lü, G. (2013) · Communications in computer and information science · doi:10.1007/978-3-642-35795-4_16 · Cited by 23
Using Entropy to Classify Traffic More Deeply
Wang, Y., Zhang, Z., Guo, L., & Li, S. (2011) · IEEE International Conference on Networking, Architecture and Storage (NAS) · doi:10.1109/nas.2011.18 · Cited by 23
Stapko, T. (2008) · Elsevier eBooks · doi:10.1016/b978-075068215-2.50005-7 · Cited by 19
Classifying SSH encrypted traffic with minimum packet header features using genetic programming
Alshammari, R., Lichodzijewski, P., Heywood, M. I., & Zincir-Heywood, N. (2009) · Genetic and Evolutionary Computation Conference Companion (GECCO Companion) · doi:10.1145/1570256.1570358 · Cited by 16
A Preliminary Performance Comparison of Two Feature Sets for Encrypted Traffic Classification
Alshammari, R., & Zincir-Heywood, N. (2008) · Advances in soft computing · doi:10.1007/978-3-540-88181-0_26 · Cited by 15
An Investigation of Multi-objective Genetic Algorithms for Encrypted Traffic Identification
Bacquet, C., Zincir-Heywood, N., & Heywood, M. I. (2009) · Advances in intelligent and soft computing · doi:10.1007/978-3-642-04091-7_12 · Cited by 14
Research works printed but not linked: 11
- ISO, 1994, ISO/IEC 7498‐1:1994 Information technology—Open Systems Interconnection—Basic Reference Model: The Basic Model
- MeyerC.20 Years of SSL/TLS Research. An Analysis of the Internet's Security Foundation.Ph.D. Thesis 2014.
- Stallings W, 2009, Protocol basics: Secure Shell protocol, The Internet Protocol Journal, 12, 18
- Blake‐WilsonS NystromM HopwoodD MikkelsenJ WrightT.Transport Layer Security (TLS) Extensions.Technical ReportRFC 4366 (Proposed Standard) Internet Engineering Task Force 2006 Obsoleted by RFCs 5246 6066 updated by RFC 5746. · doi:10.17487/rfc4366
- KochR RodosekGD.Command evaluation in encrypted remote sessions.InProceedings of the 2010 Fourth International Conference on Network and System Security NSS '10.IEEE Computer Society:Washington DC USA 2010;299–305. · doi:10.1109/nss.2010.62
- 10.1007/978-3-642-30633-4_11 · doi:10.1007/978-3-642-30633-4_11
- OkadaY AtaS NakamuraN NakahiraY OkaI.Application identification from encrypted traffic based on characteristic changes by encryption.In2011 IEEE International Workshop Technical Committee on Communications Quality and Reliability (CQR) Naples Florida USA 2011;1–6. · doi:10.1109/cqr.2011.5996087
- 10.1007/s11235-013-9690-5 · doi:10.1007/s11235-013-9690-5
- AmoliPV HamalainenT.A real time unsupervised NIDS for detecting unknown and encrypted network attacks in high speed network.In2013 IEEE International Workshop on Measurements and Networking Proceedings (M&N) Naples Italy 2013;149–154. · doi:10.1109/iwmn.2013.6663794
- CAIDA.Cyber‐security Research Ethics Dialog & Strategy Workshop 2013. Available from:http://www.caida.org/ workshops/creds/1305/[30 November 2014].
- IETF.IETF 88 Proceedings Technical Plenary 2014. Available from:http://www.ietf.org/proceedings/88/technical‐plenary.html[30 November 2014].
Cited by
Deep packet: a novel approach for encrypted traffic classification using deep learning
Lotfollahi, M., Jafari Siavoshani, M., Shirali Hossein Zade, R., & Saberian, M. (2020) · Soft Computing · doi:10.1007/s00500-019-04030-2 · Cited by 1,190
End-to-end encrypted traffic classification with one-dimensional convolution neural networks
Wang, W., Zhu, M., Wang, J., Zeng, X., & Yang, Z. (2017) · 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2017.8004872 · Cited by 991
FS-Net: A Flow Sequence Network For Encrypted Traffic Classification
Liu, C., He, L., Xiong, G., Cao, Z., & Li, Z. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737507 · Cited by 630
Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey
Shen, M., Ye, K., Liu, X., Zhu, L., Kang, J., Yu, S., Li, Q., & Xu, K. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3208196 · Cited by 265
Ullah, S., Zheng, J., Din, N., Hussain, M. T., Ullah, F., & Yousaf, M. (2023) · Computer Science Review · doi:10.1016/j.cosrev.2022.100530 · Cited by 195
Metadata
- Authors
- Velan, P., Čermák, M., Čeleda, P., & Drašar, M.
- Venue
- International Journal of Network Management
- Publisher
- Wiley
- Published
- 2015-07-15
- Volume
- 25
- Issue
- 5
- Pages
- 355-374
- ISSN
- 1055-7148 (ISSN-L)
- 1099-1190
- OpenAlex
- W2613715541
- Cited by
- 377
- References
- 50
- FWCI
- 13.14
- Type
- journal article
- Language
- en
- Open access
- green
- Funders
- Ministry of the Interior of the Czech Republic (VF)
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
