Machine learning classification of encrypted network traffic

Abstract

A system for labelling and classification of encrypted network traffic is disclosed. The system employs a Labeler, having a semi-supervised machine learning module for semi-automated labeling of encrypted network traffic, with an initial involvement of a human-in-the-loop intelligence for rapid training of the Labeler. The Labeler produces a labeled training set of encrypted network traffic flows. The system further includes a Modeler having a genetic algorithm module, for automatically selecting a list of network traffic features for further use in real-time classification of the encrypted network traffic, and outputting a corresponding classification model. The system further includes a Classifier for real-time classification of the encrypted network traffic using the classification model. Corresponding methods for labeling and classifying the encrypted network traffic are also provided.