2010-yanai-realtime-classification-encrypted
canonical link → · doi: 10.1007/978-3-642-13193-6_32
findings extracted from this paper
Classical port-based and payload-based traffic classification approaches have documented shortcomings that motivated statistical learning-based methods. By 2010, statistical classifiers operating on packet-size and timing features had become the dominant replacement, applicable even when the transport is fully encrypted.
The hybrid k-means / k-NN classifier was implemented and integrated into a real-time embedded network environment, demonstrating that ML-based encrypted traffic classification is feasible as inline line-rate infrastructure, not just an offline research technique.
A hybrid k-means / k-NN geometric classifier achieves real-time classification of encrypted network traffic by application type. The classifier is described as 'extremely robust to encryption' based on feasibility tests, including integration into a real-time embedded environment.