The DOI matches its Crossref record; 30 of the 32 references it cites were found in a registry or an index.
Machine learning based encrypted traffic classification: Identifying SSH and Skype
Abstract
The objective of this work is to assess the robustness of machine learning based traffic classification for classifying encrypted traffic where SSH and Skype are taken as good representatives of encrypted traffic. Here what we mean by robustness is that the classifiers are trained on data from one network but tested on data from an entirely different network. To this end, five learning algorithms — AdaBoost, Support Vector Machine, Naïe Bayesian, RIPPER and C4.5 — are evaluated using flow based features, where IP addresses, source/destination ports and payload information are not employed. Results indicate the C4.5 based approach performs much better than other algorithms on the identification of both SSH and Skype traffic on totally different networks.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Hence, it generalizes well from one network to another.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“For SSH traffic, it achieves 95.9% DR and 2.8% FPR on the Dalhousie dataset, 97.2% DR and 0.8% FPR on the AMP dataset, and 82.9% DR and 0.5% FPR on the MAWI dataset.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“The identification of Skype traffic at the flow level is also addressed in Alshammari et al. [17] by employing supervised AdaBoost, Repeated Incremental Pruning to Produce Error Reduction (RIPPER), SVM, NB and C4.5 DT classifiers.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“In the evaluation, C4.5 DT outperform the other classifiers for the majority of datasets.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“The C4.5 DT classifier also performed well for Skype traffic with 98.4% DR and 7.8% FPR in the Dalhousie dataset.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“Furthermore, when trained and tested across datasets (i.e.across networks), it achieves 83.7% DR and 1.5% FPR.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
In the citing paper
“Unfortunately, Alshammari et al. [17] do not detect the precise applications within a secure session.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [17]
Citations
Cites
An Introduction to the Bootstrap
Efron, B., & Tibshirani, R. J. (1994) · doi:10.1201/9780429246593 · Cited by 40,500
(1992) · Cited by 23,431
A Tutorial on Support Vector Machines for Pattern Recognition
Burges, C. J. C. (1998) · Data Mining and Knowledge Discovery · doi:10.1023/a:1009715923555 · Cited by 16,616
Cohen, W. W. (1995) · Elsevier eBooks · doi:10.1016/b978-1-55860-377-6.50023-2 · Cited by 3,890
A TUTORIAL ON SUPPORT VECTOR MACHINES FOR PATTERN RECOGNITION, DATA MINING AND KNOWLEDGE DISCOVERY
Burger, C. J. C. (1998) · Cited by 3,261
Estimating Continuous Distributions in Bayesian ClassifiersPreprint
John, G. H., & Pat Langley, B. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1302.4964 · Cited by 2,914
Introduction to Machine Learning
(2019) · Series in machine perception and artificial intelligence · doi:10.1142/9789811201967_0001 · Cited by 1,638
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801
Flagged first, then by citations
2 of the 32 references couldn’t be matched to a known paper.
Research works printed but not linked: 10
- suh, 2006, Characterizing and detecting relayed traffic: A case study using skype, INFOCOM 06 Proceedings of the 25th IEEE International Conference on Computer Communications
- 0, NLANR
- 0, MAWI
- 0, PacketShaper
- 0, 17-Filter
- 0, WEKA Software
- montigny-leboeuf, 2005, Flow Attributes For Use In Traffic Characterization, Journal of CRC Technical Note No CRC-TN-2005–003 Ottawa ON Canada
- zhang, 2000, Detecting back doors, Proceedings of the 9th Usenix Security Symposium, 157
- 0, NetMate
- 0, IETF
Cited by
Sorted by citations
Items 201–202 of 202
Yahaya, A., & Liu, Q. (2026) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri69576.2026.00038
Machine Learning-Based Identification of Encrypted VPN and Non-VPN Network Traffic
Reddy, C. V., Ullas, S., & Sreerag, G. (2026) · International Conference on Emerging Technologies in Computing and Communication (ETCC) · doi:10.1109/etcc69750.2026.11681992
Metadata
- Authors
- Alshammari, R., & Zincir-Heywood, A. N.
- Affiliations
- Dalhousie University (CA)
- ORCID
- Alshammari, Riyad
- Venue
- 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications
- Publisher
- IEEE
- Published
- 2009-07
- Pages
- 1-8
- OpenAlex
- W2158215699
- Cited by
- 202
- References
- 32
- Citations by year
- 2026: 4 · 2025: 7 · 2024: 15 · 2023: 14 · 2022: 17 · 2021: 18 · 2020: 13 · 2019: 11 · 2018: 13 · 2017: 16 · 2016: 10 · 2015: 9 · 2014: 15 · 2013: 17 · 2012: 8
- FWCI
- 5.40
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) (publishedVersion)
- Funders
- Mitacs
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Wireless Signal Modulation Classification
- Keywords
- encrypted traffic classification, classifier robustness, flow-based features, C4.5 decision tree, AdaBoost, support vector machine, naive Bayes, RIPPER, network traffic analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
