DSCA: An Inline and Adaptive Application Identification Approach in Encrypted Network Traffic

Adaptive application detection in today's high-bandwidth networks is resource consuming and inaccurate due to the high volume, velocity, and variety characteristics of the networks traffic. To generate a robust classifier for identifying applications over encrypted traffic, we proposed DSCA as a DPI-based Stream Classification Algorithm. DSCA utilizes applications detected by the DPI, Deep Packet Inspection technique, as ground truth data and updates the classification model accordingly. To reduce the classification algorithms overhead without accuracy reduction, a feature selection method, named CfsSubsetEval, is deployed in DSCA. The proposed approach is implemented via the MOA tool and the performance is evaluated through UNB ISCX VPN-nonVPN and UNB ISCX Tor-nonTor datasets. 10 different stream and traditional classification algorithms are integrated with DSCA. The simulation results represent DSCA with Adaptive Random Forest stream classification algorithm has the best performance over UNB ISCX VPN-nonVPN which processed the dataset in 8.63 seconds with 96.75% accuracy. About UNB ISCX Tor-nonTor dataset, DSCA and Knn with PAW classification algorithm have the best performance (86.92% accuracy and 12.05 seconds execution time).