Abstract:Traffic analysis is the process of monitoring network activities, discovering specific patterns, and gleaning valuable information from network traffic. It can be applied in various fields such as network assert probing and anomaly detection. With the advent of network traffic encryption, however, traffic analysis becomes an arduous task. Due to the invisibility of packet payload, traditional traffic analysis methods relying on capturing valuable information from plaintext payload are likely to lose efficacy. Machine learning has been emerging as a powerful tool to extract informative features without getting access to payload, and thus is widely employed in encrypted traffic analysis. In this paper, we present a comprehensive survey on recent achievements in machine learning-powered encrypted traffic analysis. To begin with, we review the literature in this area and summarize the analysis goals that serve as the basis for literature classification. Then, we abstract the workflow of encrypted traffic analysis with machine learning tools, including traffic collection, traffic representation, traffic analysis method, and performance evaluation. For the surveyed studies, the requirements of classification granularity and information timeliness may vary a lot for different analysis goals. Hence, in terms of the goal of traffic analysis, we present a comprehensive review on existing studies according to four categories: network asset identification, network characterization, privacy leakage detection, and anomaly detection. Finally, we discuss the challenges and directions for future research on encrypted traffic analysis.

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

Hybrid Internet Traffic Classification Technique

Classifying encrypted traffic using adaptive fingerprints with multi-level attributes

Classifying Tor Traffic Encrypted Payload Using Machine Learning

Drpsd: An Novel Method Of Identifying Ssl/Tls Traffic

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

A Deep Learning-Based Encrypted VPN Traffic Classification Method Using Packet Block Image

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

RM-Net: an Encrypted Traffic Classification Method Based on Deep Learning for Low Labeled Rate Scenarios

Few-Shot Encrypted Traffic Classification: A Survey

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML