Entropy Estimation for Real-Time Encrypted Traffic Identification

Sökning: WFRF:(Tamm R) > Entropy Estimation ...

This paper describes a novel approach to classify network traffic into encrypted and unencrypted traffic. The classifier is able to operate in real-time as only the first packet of each flow is processed. The main metric used for classification is an estimation of the entropy of the first packet payload. The approach is evaluated based on encrypted ground truth traces and on real network traces. Encrypted traffic such as Skype, or encrypted eDonkey traffic are detected as encrypted with probability higher than 94%. Unencrypted protocols such as SMTP, HTTP, POP3 or FTP are detected as unencrypted with probability higher than 99.9%. The presented approach, named real-time encrypted traffic detector (RT-ETD), is well suited to operate as pre-filter for advanced classification approaches to enable their applicability on increased bandwidth.

Panholzer, Georg (författare)
John, Wolfgang,1978Chalmers tekniska högskola,Chalmers University of Technology(Swepub:cth)johnwolf (författare)
Chalmers tekniska högskola (creator_code:org_t)

Ingår i:Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)Berlin, Heidelberg : Springer Berlin Heidelberg6613, s. 164-1711611-33490302-97439783642203046

Av författaren/redakt...: Dorfinger, Peter; Panholzer, Georg; John, Wolfgang, ...

Om ämnet

TEKNIK OCH TEKNOLOGIER: TEKNIK OCH TEKNO ...; och Elektroteknik oc ...; och Telekommunikatio ...

Kungliga biblioteket hanterar dina personuppgifter i enlighet med EU:s dataskyddsförordning (2018), GDPR. Läs mer om hur det funkar här.
Så här hanterar KB dina uppgifter vid användning av denna tjänst.