Mathematical Foundations of Computer Science and Computer Security

Identification of the features of encrypted traffic for various forms of user activity in global information exchange systems

V. I. Dobryakov, A. A. Smirnov


Abstract: We discuss the problem of forming an optimal set of features that make it possible to classify user activity (text exchange, video call, audio call, file download, etc.) according to the encrypted data stream generated by rapid messaging applications (messengers) and observed in the global information exchange system. A structural and statistical approach to the formation of user activity features has been proposed combining the methodology of DPI, SPI and statistical approach to traffic classification, semantic and correlation selection of the most significant features. The main result is a method for obtaining an optimized set of traffic features for a multiclass classification of user activity with an achieved quality measure $ F_1 \in [0.8, 0.95]$ for a simple decision tree model.

Keywords: feature engineering, structural and statistical analysis, correlation, DPI, SPI, user activity, trafic classification.

UDC: 004.04

DOI: 10.17223/2226308X/18/41