CPL - Chalmers Publication Library
| Utbildning | Forskning | Styrkeområden | Om Chalmers | In English In English Ej inloggad.

Entropy Estimation for Real-Time Encrypted Traffic Identification

Peter Dorfinger ; Georg Panholzer ; Wolfgang John (Institutionen för data- och informationsteknik, Nätverk och system (Chalmers) )
Lecture Notes in Computer Science. 3rd International Workshop on Traffic Monitoring and Analysis, TMA 2011, Vienna, 27 April 2011 (0302-9743). Vol. 6613 (2011), p. 164-171.
[Konferensbidrag, refereegranskat]

This paper describes a novel approach to classify network traffic into encrypted and unencrypted traffic. The classifier is able to operate in real-time as only the first packet of each flow is processed. The main metric used for classification is an estimation of the entropy of the first packet payload. The approach is evaluated based on encrypted ground truth traces and on real network traces. Encrypted traffic such as Skype, or encrypted eDonkey traffic are detected as encrypted with probability higher than 94%. Unencrypted protocols such as SMTP, HTTP, POP3 or FTP are detected as unencrypted with probability higher than 99.9%. The presented approach, named real-time encrypted traffic detector (RT-ETD), is well suited to operate as pre-filter for advanced classification approaches to enable their applicability on increased bandwidth.

Nyckelord: entropy estimation, real-time detection, traffic filtering



Den här publikationen ingår i följande styrkeområden:

Läs mer om Chalmers styrkeområden  

Denna post skapades 2011-06-01. Senast ändrad 2013-08-27.
CPL Pubid: 141314