TCC: Time constrained classification of VPN and non-VPN traffic using machine learning algorithms
摘要
Accurate traffic classification plays an important role in efficient utilization of network resources, quality of service, and overall management of the network. The identification of virtual private network (VPN) traffic, in particular, is important since it allows distinguishing between encrypted and non-encrypted traffic by VPN service, which is critical for security monitoring, traffic shaping, and the detection of possible misuse of network resources. VPNs are secure, encrypted connections over an insecure network with predetermined protocols; hence, through traditional methods, it is quite challenging to recognize the traffic pattern. This work introduces the time constrained classification (TCC) model, which use a decision tree classification algorithm with autoencoder dimensionality reduction to extract the key features from encrypted VPN traffic. The TCC model accurately classify VPN traffic from non-VPN traffic without degrading performance and limited amount of time. This approach optimizes the classification time for both binary and multi-class VPN and non-VPN traffic. Experimental results show that the decision tree-based autoencoder model achieves a recall score of 0.993 for multi-class classification in 1.8 s on the UNB ISCX VPN-nonVPN dataset (ISCXVPN2016), outperforming state-of-the-art methods while significantly reducing classification time.