Differentiation of Sliding Rescaled Ranges: New Approach to Encrypted and VPN Traffic Detection

TL;DR

This paper introduces DSRR, a novel traffic preprocessing method inspired by Hurst's work, which improves encrypted and VPN traffic detection accuracy using machine learning on the ISCXVPN2016 dataset.

Contribution

The paper presents DSRR, a new traffic preprocessing technique that enhances VPN traffic detection accuracy with traditional and neural network models.

Findings

DSRR combined with Random Forest achieves 0.976 precision.

Neural Network with 2D-CNN achieves 0.93 precision.

DSRR improves feature characterization for encrypted traffic detection.

Abstract

We propose a new approach to traffic preprocessing called Differentiation of Sliding Rescaled Ranges (DSRR) expanding the ideas laid down by H.E. Hurst. We apply proposed approach on the characterizing encrypted and unencrypted traffic on the well-known ISCXVPN2016 dataset. We deploy DSRR for flow-base features and then solve the task VPN vs nonVPN with basic machine learning models. With DSRR and Random Forest, we obtain 0.971 Precision, 0.969 Recall and improve this result to 0.976 using statistical analysis of features in comparison with Neural Network approach that gives 0.93 Precision via 2D-CNN. The proposed method and the results can be found at https://github.com/AleksandrIvchenko/dsrr_vpn_nonvpn.