Encrypted Traffic Classification Based on Unsupervised Learning in Cellular Radio Access Networks

Traffic classification will be a key aspect in the operation of future 5G cellular networks, where services of very different nature will coexist. Unfortunately, data encryption makes this task very difficult. To overcome this issue, flow-based schemes have been proposed based on payload-independent features extracted from the Internet Protocol (IP) traffic flow. However, such an approach relies on the use of expensive traffic probes in the core network. Alternatively, in this paper, an offline method for encrypted traffic classification in the radio interface is presented. The method divides connections per service class by analyzing only features in radio connection traces collected by base stations. For this purpose, it relies on unsupervised learning, namely agglomerative hierarchical clustering. Thus, it can be applied in the absence of labeled data (seldom available in operational cellular networks). Likewise, it can also identify new services launched in the network. Method assessment is performed over a real trace dataset taken from a live Long Term Evolution (LTE) network. Results show that traffic shares per application class estimated by the proposed method are similar to those provided by a vendor report.