Combining raw data and engineered features for optimizing encrypted and compressed internet of things traffic classification

Abstract

The Internet of Things (IoT) is used in many fields that generate sensitive data, such as healthcare and surveillance. The increased reliance on IoT raised serious information security concerns. As IoT traffic is often compressed to optimize resource consumption, sending compressed data without encryption is a significant security risk for violating confidentiality, integrity, and privacy, as the data can be decompressed, read, and modified. The randomization generated by data compression can complicate classifying compressed data from encrypted data. Encrypted and compressed traffic classification is crucial for the security and forensic analysis of IoT implementations. Existing encrypted and compressed data classification approaches suffer from various limitations. This work proposes two Deep Learning (DL) systems to enhance traffic classification with an emphasis on reducing the possibility of falsely classifying compressed traffic as encrypted. The first approach is Engineered Features Classification (EFC), which uses a set of statistical tests. The second approach is Raw Data and Engineered Features Classification (RDEFC), which combines raw data and statistical tests to improve the classification of encrypted and compressed traffic. Our work also addresses the complexity of classifying encrypted samples of compressed files, such as encrypted JPG images. A large dataset is built in this work with different file types, which include TXT, HTML, WAV, PDF, and JPG. Our evaluation results show high performance for the EFC system with classification 80.94% accuracy. The RDEFC system has a significant improvement over the former with 90.55% classification accuracy. Our approaches outperform systems reported in the literature with similar configurations.