A Comparison of Unsupervised Learning Techniques for Encrypted Traffic Identification

The increasing use of encrypted traffic combined with non-standard port associations makes the task of traffic identification increasingly difficult. This work benchmarks the performance of five unsupervised clustering algorithms: Basic K-Means, Semi-supervised K-Means, DBSCAN, EM, and MOGA for encrypted traffic identification, specifically SSH. Results show that the performance of MOGA, a multi objective clustering approach using a Genetic Algorithm, is not only better than the others, but also provides a good trade off in terms of detection rate, false positive rate, and time to built and run the model. This is a very desirable property for a potential implementation of an encrypted traffic identification system.