Ultimate Encrypted Traffic Feature Engineering: HTTPS Encrypted Traffic Classification Using Restored Application Data Unit Length

Summary

Researchers propose Application Data Unit (ADU) length as a feature for classifying HTTPS encrypted traffic from over-the-top applications, since packet length sequences are distorted by protocol piecewise decoupling and encryption covering. They train a Length-Correction Multiple Regression Neural Network (LC-MRNN) to restore true ADU lengths, which the TLS encryption that covers the HTTP header prevents from being read directly. In experiments on the real CERNET network with HTTP-1.1 and HTTP-2.0, the method, paired with an LS-LSTM classifier, reaches an F1-score of 93.52%, about 4.2% higher than state-of-the-art methods.