Information technology for classification of encrypted traffic in corporate networks using machine learning

Abstract

Currently, there is growing interest in the tasks of effective management of packet networks, namely: quality of service, ensuring information security, optimization of the use of hardware and software resources of the network. All these tasks are largely based on the analysis and classification of network traffic. Traffic classification allows you to identify packets of various applications and services and ensure their prioritization during transmission over the network. Today, the task is relevant both from the point of view of network administration and from the point of view of ensuring its security. Given the fact that a large number of applications now have encryption, traffic classification is of particular interest, which makes it possible to indirectly identify anomalies in the network. All of the above confirms that the identification and classification of traffic of data transmission networks is an important topic of research, as they determine the main steps in creating a traffic management model when solving the problems of correct application of the security policy. The article considers the problem of network traffic classification using machine learning methods. Various statements of the task are presented, the characteristics used for its solution, existing approaches and areas of their applicability are described. The properties of network traffic are analyzed, due to the characteristics of the transmission environment, as well as the technologies used, which somehow affect the classification process.