Bayesian Neural Network Based Encrypted Traffic Classification using Initial Handshake Packets

Traffic classification has garnered significant attention from researchers owing to its applicability in a wide range of network management systems. The identification and categorization of network traffic are usually based on various parameters such as the port numbers, payload signatures, and statistical features. These methods face difficulty in classifying encrypted traffic flows for secure communication. We propose a novel payload-based classification that exploits unencrypted handshake packets, which are exchanged between the end hosts for transport layer security establishment. We use Bayesian neural network as the classifier, which takes cipher suite, compression method, and TLS extension information of the handshake packets as the inputs. We conducted comparative experiments to show that the proposed method outperforms other traditional payload-based classifiers.