Flow Classification of Encrypted Traffic Streams using Multi-fractal Features

Abstract: The increased usage of encrypted application layer traffic is making it harder for traditional traffic categorization methods like deep packet inspection to function. Without ways of categorizing traffic, network service providers have a hard time optimizing traffic flows, resulting in worse quality of experience for the end user. Recent solutions to this problem typically apply some statistical measurements on network flows and use the resulting values as features in a machine learning model. However, by utilizing recent advances in multi-fractal analysis, multi-fractal features can be extracted from time-series via wavelet leaders, which can be used as features instead. In this thesis, these features are used exclusively, together with support vector machines, to build a model that categorizes encrypted network traffic into six categories that, according to a report, accounts for over 80% of the mobile traffic composition. The resulting model achieved a F1-score of 0.958 on synthetic traffic while only using multi-fractal features, leading to the conclusion that incorporating multi-fractal features in a traffic categorization framework, implemented at a base station, would be beneficial for the categorization score for such a framework.