METHOD FOR CLASSIFYING THE PAYLOAD OF ENCRYPTED TRAFFIC FLOWS

摘要

A method is implemented by a network device to classify encrypted data traffic. The method identifies characteristics of the encrypted data traffic that have been modeled where network anomalies have been injected into the encrypted data traffic to provide additional traffic characteristics that enable categorization. The method receives the encrypted data traffic, applies an encrypted traffic categorization model to the received encrypted data traffic to determine a first categorization identification, injects an anomaly into the encrypted data traffic where the first categorization identification is not within a precision threshold, applies the encrypted traffic categorization model to monitored encrypted traffic after injection of the anomaly to determine a second categorization identification, and applies the second categorization identification where the second categorization identification is within the precision threshold.