Realtime classification for encrypted traffic

Roni Bar-Yanai, Michael Langberg, David Peleg, Liam Roditty

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Classifying network flows by their application type is the backbone of many crucial network monitoring and controlling tasks, including billing, quality of service, security and trend analyzers. The classical "port-based" and "payload-based" approaches to traffic classification have several shortcomings. These limitations have motivated the study of classification techniques that build on the foundations of learning theory and statistics. The current paper presents a new statistical classifier that allows real time classification of encrypted data. Our method is based on a hybrid combination of the k-means and knearest neighbor (or k-NN) geometrical classifiers. The proposed classifier is both fast and accurate, as implied by our feasibility tests, which included implementing and intergrading statistical classification into a realtime embedded environment. The experimental results indicate that our classifier is extremely robust to encryption.

Original languageEnglish
Title of host publicationExperimental Algorithms - 9th International Symposium, SEA 2010, Proceedings
Number of pages13
StatePublished - 2010
Event9th International Symposium on Experimental Algorithms, SEA 2010 - Naples, Italy
Duration: 20 May 201022 May 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6049 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference9th International Symposium on Experimental Algorithms, SEA 2010


Dive into the research topics of 'Realtime classification for encrypted traffic'. Together they form a unique fingerprint.

Cite this