Digging into HTTPS: flow-based classification of webmail traffic
Abstract
Recently, webmail interfaces, e.g., Horde, Outlook Web Access, and webmail platforms such as GMail, Yahoo!, and Hotmail have seen a tremendous boost in popularity. Given the importance of e-mail for personal and business use alike, and its exposure to imminent threats, there exists the need for a comprehensive view of the Internet mail system, including webmail traffic. We, in this paper, propose a novel, passive approach to identify webmail traffic solely based on network-level data in order to obtain a comprehensive view of the mail system. Key to our approach is that we leverage correlations across protocols and time to introduce three novel features for HTTPS webmail classification. Our first feature is based on the finding that webmail servers tend to reside close to legacy mail servers, e.g. IMAP and POP, which can be easily identified. Our second feature leverages that the usage of webmail services results in distinct patterns on sessions' duration and on the diurnal/weekly traffic usage profile. In addition, our third feature exploits the observation that traffic flows to webmail platforms exhibit inherent periodicities due to the fact that AJAX-based clients periodically check for new messages. We use these three features to build a simple classifier and detect webmail traffic on real-world NetFlow traces from a medium-sized backbone network. We believe that the major contribution of this paper -- exploring a set of new features that could classify applications that run over HTTPS ports solely based on NetFlow data -- will stimulate more general advance in the field of traffic classification.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Schatzmann et al.'s classifier achieves an average accuracy of 93.2% and a precision of 79.2% using 5-fold cross validation.
“Using 5-fold cross validation, the classifier achieves an average accuracy of 93.2% and a precision of 79.2%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [404]
The higher false negative rate in Schatzmann et al.'s classifier is attributed to the inability of the classifier to distinguish between VPN and webmail servers.
“The higher FN is attributed to the inability of the classifier to distinguish between VPN and webmail servers.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [404]
Service proximity, activity profiles, session duration, and periodicity act as good discriminators for a SVM classifier to differentiate between webmail and non-webmail traffic.
“The authors show that these features act as good discriminators for a SVM classifier to differentiate between webmail and nonwebmail traffic.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [404]
Cites
LIBSVM: A library for support vector machines
Chang, C.-C., & Lin, C.-J. (2011) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/1961189.1961199 · Cited by 40,918 · see citing works
Libsvm : A library for support vector machines
Ferrari, V. (2008) · Medical Entomology and Zoology · Cited by 10,124 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Research design and statistical analysis
Myers, J. L., Well, A. D., & Lorch, R. F. (2011) · Choice Reviews Online · doi:10.5860/choice.48-4538 · Cited by 1,213 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Understanding the network-level behavior of spammers
Ramachandran, A., & Feamster, N. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159947 · Cited by 511 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
Understanding the network-level behavior of spammers
Ramachandran, A., & Feamster, N. (2006) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1159913.1159947 · Cited by 243 · see citing works
Network monitoring using traffic dispersion graphs (tdgs)
Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S. R., & Varghese, G. (2007) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298349 · Cited by 190 · see citing works
Dynamic application-layer protocol analysis for network intrusion detection
Dreger, H., Feldmann, A., Mai, M., Paxson, V., & Sommer, R. (2006) · MPG.PuRe (Max Planck Society) · Cited by 180 · see citing works
Research Design and Statistical Analysis
Rotello, C. M., Myers, J. L., Well, A. D., & Lorch, R. F. (2024) · Routledge eBooks · doi:10.4324/9781003453550 · Cited by 165 · see citing works
Detecting spammers with SNARE: spatio-temporal network-level automatic reputation engine
Hao, S., Syed, N. A., Feamster, N., Gray, A., & Krasser, S. (2009) · Cited by 144 · see citing works
Accurate Classification of the Internet Traffic Based on the SVM Method
Li, Z., Yuan, R., & Guan, X. (2007) · International Conference on Communications · doi:10.1109/icc.2007.231 · Cited by 118 · see citing works
Karagiannis, T., Papagiannaki, K., Taft, N., & Faloutsos, M. (2007) · Springer eBooks · doi:10.1007/978-3-540-71617-4_19 · Cited by 74 · see citing works
The New Web: Characterizing AJAX Traffic
Schneider, F., Agarwal, S., Alpcan, T., & Feldmann, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-79232-1_4 · Cited by 69 · see citing works
Content-aware Internet application traffic measurement and analysis
Choi, T., Kim, C., Yoon, S., Park, J., Lee, B. J., Kim, H., Chung, H., & Jeong, T. S. (2004) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms.2004.1317737 · Cited by 45 · see citing works
Classifying HTTP Traffic in the New Age
Li, W., Moore, A. W., & Canini, M. (2008) · Cited by 22 · see citing works
Inferring Spammers in the Network Core
Schatzmann, D., Burkhart, M., & Spyropoulos, T. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-00975-4_23 · Cited by 20 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
A survey of network flow applications
Li, B., Springer, J., Bebis, G., & Güneş, M. H. (2013) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2012.12.020 · Cited by 225 · see citing works
A Review on Machine Learning Strategies for Real-World Engineering Applications
Jhaveri, R. H., Revathi, A. R., Ramana, K., Raut, R., & Dhanaraj, R. K. (2022) · Mobile Information Systems · doi:10.1155/2022/1833507 · Cited by 124 · see citing works
Internet Traffic Classification Using Constrained Clustering
Wang, Y., Xiang, Y., Zhang, J., Zhou, W., Wei, G., & Yang, L. T. (2014) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2013.307 · Cited by 109 · see citing works
A Survey on Encrypted Traffic Classification
Cao, Z., Xiong, G., Zhao, Y. T., Li, Z., & Guo, L. (2014) · Communications in computer and information science · doi:10.1007/978-3-662-45670-5_8 · Cited by 96 · see citing works
In-Network Machine Learning Using Programmable Network Devices: A Survey
Zheng, C., Hong, X., Ding, D., Vargaftik, S., Ben-Itzhak, Y., & Zilberman, N. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344351 · Cited by 90 · see citing works
A multi-level framework to identify HTTPS services
Shbair, W. M., Cholez, T., Francois, J., & Chrisment, I. (2016) · NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium · doi:10.1109/noms.2016.7502818 · Cited by 69 · see citing works
Characterizing resource usage for mobile web browsing
Qian, F., Sen, S. B., & Spatscheck, O. (2014) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/2594368.2594372 · Cited by 69 · see citing works
Behavior Analysis of Internet Traffic via Bipartite Graphs and One-Mode Projections
Xu, K., Wang, F., & Gu, L. (2013) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2013.2264634 · Cited by 66 · see citing works
ReSurf: Reconstructing web-surfing activity from network traffic
Xie, G., Iliofotou, M., Karagiannis, T., Faloutsos, M., & Jin, Y. (2013) · Cited by 54 · see citing works
A novel semi-supervised approach for network traffic clustering
Wang, Y., Xiang, Y., Zhang, J., & Yu, S. (2011) · International Conference on Network and System Security (NSS) · doi:10.1109/icnss.2011.6059997 · Cited by 45 · see citing works
Internet traffic clustering with side information
Wang, Y., Xiang, Y., Zhang, J., Zhou, W., & Xie, B. (2014) · Journal of Computer and System Sciences · doi:10.1016/j.jcss.2014.02.008 · Cited by 37 · see citing works
A supervised machine learning approach to classify host roles on line using sFlow
Li, B., Güneş, M. H., Bebis, G. N., & Springer, J. (2013) · doi:10.1145/2465839.2465847 · Cited by 28 · see citing works
Real-time creation of bitmap indexes on streaming network data
Fusco, F., Vlachos, M., & Stoecklin, M. P. (2011) · The VLDB Journal · doi:10.1007/s00778-011-0242-x · Cited by 24 · see citing works
Automatic discovery of web servers hosting similar applications
Kohout, J., & Pevný, T. (2015) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · doi:10.1109/inm.2015.7140487 · Cited by 16 · see citing works
Iterative-tuning support vector machine for network traffic classification
Hong, Y., Huang, C., Nandy, B., & Seddigh, N. (2015) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · doi:10.1109/inm.2015.7140323 · Cited by 16 · see citing works
Network traffic clustering using Random Forest proximities
Wang, Y., Xiang, Y., & Zhang, J. (2013) · International Conference on Communications · doi:10.1109/icc.2013.6654829 · Cited by 16 · see citing works
A Survey on SDN and SDCN Traffic Measurement: Existing Approaches and Research Challenges
Islam, M. S., Al-Mukhtar, M., Khan, M. R. K., & Hossain, M. (2023) · Eng—Advances in Engineering · doi:10.3390/eng4020063 · Cited by 16 · see citing works
How HTTP/2 is changing web traffic and how to detect it
Manzoor, J., Drago, I., & Sadre, R. (2017) · Network Traffic Measurement and Analysis Conference (TMA) · doi:10.23919/tma.2017.8002899 · Cited by 14 · see citing works
Tor Traffic Classification Based on Encrypted Payload Characteristics
Choorod, P., & Weir, G. R. S. (2021) · National Computing Colleges Conference (NCCC) · doi:10.1109/nccc49330.2021.9428874 · Cited by 13 · see citing works
Behavioral Graph Analysis of Internet Applications
Xu, K., & Wang, F. (2011) · Globecom · doi:10.1109/glocom.2011.6133613 · Cited by 13 · see citing works
A Survey of HTTPS Traffic and Services Identification ApproachesPreprint
Shbair, W. M., Cholez, T., François, J., & Chrisment, I. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.08339 · Cited by 13 · see citing works
Appiah-Kubi, P., Karne, R. K., & Wijesinha, A. L. (2012) · 2012 International Conference on Computing, Networking and Communications (ICNC) · doi:10.1109/iccnc.2012.6167399 · Cited by 10 · see citing works
NSA-Net: A NetFlow Sequence Attention Network for Virtual Private Network Traffic Detection
Fu, P., Liu, C., Yang, Q., Li, Z., Gou, G., Xiong, G., & Li, Z. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-62005-9_31 · Cited by 10 · see citing works
Internet traffic clustering with constraints
Wang, Y., Xiang, Y., Zhang, J., & Yu, S. (2012) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2012.6314275 · Cited by 9 · see citing works
Veiled in clouds? Assessing the prevalence of cloud computing in the email landscape
Henze, M., Sanford, M., & Hohlfeld, O. (2017) · Network Traffic Measurement and Analysis Conference (TMA) · doi:10.23919/tma.2017.8002910 · Cited by 7 · see citing works
Network Flow Query Language—Design, Implementation, Performance, and Applications
Bajpai, V. K., & Schönwälder, J. (2016) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2016.2633511 · Cited by 6 · see citing works
Classification Research on SSL Encrypted Application
Fu, P., Guo, L., Xiong, G., & Meng, J. (2013) · Communications in computer and information science · doi:10.1007/978-3-642-35795-4_51 · Cited by 6 · see citing works
Privacy-Preserving Internet Traffic Publication
Guo, L., & Shen, H. (2016) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom.2016.0152 · Cited by 4 · see citing works
A Campus-Level View of Outlook Email Traffic
Zhang, Z., & Williamson, C. L. (2018) · International Conference Network, Communication and Computing · doi:10.1145/3301326.3301371 · Cited by 4 · see citing works
Characterization of IMAPS Email Traffic
Karamollahi, M., & Williamson, C. L. (2019) · Proceedings - International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2019.00030 · Cited by 4 · see citing works
IP backbone traffic behavior characteristic spectrum composing and role mining
Zang, X., Gong, J., Huang, S., Hu, X., & Yang, Y. (2019) · CCF Transactions on Networking · doi:10.1007/s42045-019-00023-9 · Cited by 4 · see citing works
Torres, L. M., Magaña, E., Morató, D., García-Jiménez, S., & Izal, M. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.10.007 · Cited by 4 · see citing works
Can web pages be classified using anonymized TCP/IP headers?
Sanders, S., & Kaur, J. (2015) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2015.7218614 · Cited by 4 · see citing works
A sliding-window-based graph model for dynamic characteristics analysis of Internet traffic
Zhang, X., Yu, K., Yang, J., & Xu, C. (2014) · International Conference on Wireless Communication, Vehicular Technology, Information Theory and Aerospace & Electronic Systems Technology · doi:10.1109/vitae.2014.6934426 · Cited by 3 · see citing works
Identifying sessions to websites as an aggregation of related flows
Torres, L. M., Magaña, E., Izal, M., & Morató, D. (2012) · International Telecommunications Network Strategy and Planning Symposium · doi:10.1109/netwks.2012.6381703 · Cited by 3 · see citing works
A real-time network traffic classification system using cost-sensitive deep neural networks
Bechoo, C., & Mungur, A. (2024) · Journal of Ambient Intelligence and Smart Environments · doi:10.3233/ais-230620 · Cited by 2 · see citing works
Characterizing webpage load from the perspective of TCP connections
Torres, L. M., Magaña, E., Izal, M., & Morató, D. (2014) · Annals of Computer Science and Information Systems · doi:10.15439/2014f104 · Cited by 2 · see citing works
Internet traffic data categorization using particle of swarm optimization algorithm
Shrivastava, N., & Dubey, A. (2016) · Symposium on Colossal Data Analysis and Networking · doi:10.1109/cdan.2016.7570937 · Cited by 1 · see citing works
A Secure Webmail System Based on FreeBSD UNIX
Zhang, Y., & Yu-ping, Y. (2013) · International Conference on Intelligent Networks and Intelligent Systems · doi:10.1109/icinis.2013.61 · Cited by 1 · see citing works
High-speed indexing and archival of network measurement data
Fusco, F. (2012) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-a-007583321
A popularity-aware method for discovering server IP addresses related to websites
Torres, L. M., Magaña, E., Izal, M., & Morató, D. (2013) · Global Information Infrastructure and Networking Symposium · doi:10.1109/giis.2013.6684350
Glisic, S., & Lorenzo, B. (2022) · Wiley eBooks · doi:10.1002/9781119790327.ch7
Threat Detection in Network Traffic using Time Series Analysis
Koumar, J., & Čejka, T. (2026) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms69089.2026.11668313
Deep Learning for Classifying Service Priorities in Gmail Network Traffic
Aldhahery, M. A. (2025) · International Conference on Information and Communication Technology for the Muslim World (ICT4M) · doi:10.1109/ict4m68001.2025.11363548
Service-Level Monitoring of HTTPS Traffic
Shbair, W. M. (2017) · doi:10.70675/e8b31988zd1a4z424cza01ezec9263ec16be
- Authors
- Schatzmann, D., Mühlbauer, W., Spyropoulos, T., & Dimitropoulos, X.
- Affiliations
- ETH Zurich (CH)
- Venue
- Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2010-11
- Pages
- 322-327
- OpenAlex
- W2137219488
- Cited by
- 47
- References
- 26
- Citations by year
- 2026: 1 · 2025: 1 · 2024: 1 · 2023: 2 · 2022: 2 · 2021: 1 · 2020: 3 · 2019: 2 · 2018: 2 · 2017: 4 · 2016: 4 · 2015: 3 · 2014: 6 · 2013: 8 · 2012: 4
- FWCI
- 3.88
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Keywords
- NetFlow, passive network monitoring, network traffic classification, diurnal traffic patterns
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
