• Our classifiers perform better when the flows are generated using shorter timeout values, which contradicts the common assumption of using 600 ms as timeout duration. • Future work: we plan to expand our work to other applications and types of encrypted traffic, and to further study the application of time-based features to characterize encrypted traffic. FEATURE DESCRIPTION dura&on Dura&on o...

The increasing use of encrypted traffic combined with non-standard port associations makes the task of traffic identification increasingly difficult. This work adopts a multi-objective clustering approach to the problem in which a Genetic Algorithm performs both feature selection and cluster count optimization under a flow based representation. Solutions do not use port numbers, IP address or p...

The purpose of this paper proposes a network flow identification methodology considering network traffic dynamics caused by various types of recent network-based applications. In particular, P2P applications that generate encrypted packets are rarely visible to previous schemes, which have been proposed to handle packet filtering and control. Therefore, as a new strategy, we propose an efficien...

Traffic classification is critical to effective network control and management. Recent researches on Internet traffic classifications have developed several methods for identifying types of application, which have advantages in certain types of network traffic. However, these methods are powerless to measure the network traffic with dynamic port, encrypted payloads, mixing traffic, and real-tim...

In parallel with the rapid adoption of transport layer security (TLS), malware has utilized encrypted communication channel provided by TLS to hinder detection from network traffic. To this end, recent research efforts are directed toward and family classification for TLS-encrypted However, amongst their feature sets, proposals utilize sequential information each session not been properly evalu...