HTTP Tunneled Traffic Classification.

摘要

The focus of the Thesis is on the classification of dominant types of HTTP tunneled traffic, namely video, audio and file-transfers. The classification is conducted in three phases. The first, it identifies HTTP traffic with long-flow using port-based classification process. The second, using secondary parameters like download rates, bytes-per-packet and bytes-per-flow, all potential HTTP video, audio and file-transfer are segregated. The third, uses primary parameters like 'flow-group' and 'occupancy' to fine-tune and accurately classify.;The proposed scheme is tested on live data traffic in a small enterprise network that contains regular HTTP traffic besides tunneled video, audio and file-transfer applications. The proposed algorithm accurately classified at least 70% of the HTTP tunneled traffic. In some cases the accuracy is as high as 90%. The classification results are compared with approaches based on NaiveBayes algorithm and Support-Vector-Machine. The proposed scheme outperforms SVM and NaiveBayes approach by at least 10% performance measures.