Encrypted Traffic Classification

AI-powered classification of encrypted network traffic — enabling security monitoring and QoS management without compromising encryption or user privacy.

Headline result: Retrieval-based adaptation and post-quantum traffic classification.

Papers: 20
Years: 2020–2027
Co-authors: 26

Overview

Most internet traffic is now encrypted. Encryption protects privacy, but it also blinds the tools operators use to keep networks secure and fast. We build machine learning that classifies and analyses encrypted traffic without decrypting it, and keeps working as applications, protocols and threats change.

Key Contributions

New classes without retraining: classification by retrieval lets an encrypted-traffic model add new application classes in seconds and flag out-of-distribution traffic in the same retrieval step (Computer Networks, 2026).
Post-quantum traffic: PQClass, which the paper presents as the first pipeline for classifying encrypted internet traffic of recently NIST-approved post-quantum algorithms (IEEE ICC 2025).
Learning from little labelled data: data augmentation and early prediction for traffic classification (Expert Systems with Applications, 2024; IEEE ICC 2025).
Signal processing views of traffic: STFT-TC and DWT-TC turn packet time series into short-time Fourier and wavelet representations for encrypted traffic classification (IEEE CCNC 2024).
Contrastive traffic representations: SimCSE-style embeddings learned from raw packets for malicious and VPN traffic detection and zero-day attack detection (IEEE Access, 2022).

Impact

Applications include threat detection, quality-of-experience monitoring (for example, predicting game QoE from network traffic, IEEE CCNC 2026) and network management, all without decrypting user traffic. Our tools are open source, including OSF-EIMTC, a framework for standardized encrypted traffic classification (Computer Communications, 2024).

In plain words

Explainers of this line's papers for readers outside the field.

People on this line

The 8 most frequent of 26 co-authors on this line since 2020.

Ranked by joint papers in this line. The bar under each name spans their years on it, 2020 to 2027. A ring marks a student of the lab (8 of 26 co-authors here). 18 more co-authors on the Lab page

Papers

20 publications, newest first.

All publications

2027

When Evaluation Protocol Changes the Winner: Traffic Classification Beyond Architecture

Chen Hajaj, Wiam Meshleb, and Amit Dvir

ConferenceIEEE Consumer Communications & Networking Conference (CCNC) CORE B

Explainer

@inproceedings{hajaj2027evaluation,
  title = {When Evaluation Protocol Changes the Winner: Traffic Classification Beyond Architecture},
  author = {Hajaj, Chen and Meshleb, Wiam and Dvir, Amit},
  booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
  address = {Las Vegas, NV, USA},
  year = {2027},
  month = jan,
  note = {To appear},
  month_numeric = {1}
}

2026

Selected: Ultra fast encrypted network traffic classification based on classification by retrieval powered by out-of-distribution

Yehonatan Zion, Amit Dvir, Chen Hajaj, Ran Dubin, and Neriya Filber

JournalComputer Networks SJR Q1 Student-led

DOI Explainer

The dominance of encryption and the relentless growth of network traffic have rendered traditional deep packet inspection ineffective and made retraining-based machine learning classifiers operationally costly, as every new application or threat class requires a full model rebuild. In order to overcome this challenge, we present an ultra-fast encrypted traffic classification system based on Classification By Retrieval (CBR): each flow is represented by a fixed-length feature vector extracted from only the first few packets, indexed in a HNSW approximate nearest-neighbor structure, and classified by retrieving its nearest labeled neighbor. New classes are absorbed by inserting a handful of labeled vectors into the running index, with no retraining and no downtime, and out-of-distribution traffic is detected within the same retrieval step using a single global distance threshold. We evaluate handcrafted statistical features and learned CNN and MLP embeddings against a Random Forest baseline on the public CESNET-TLS22 dataset (184 application classes) and a proprietary cellular dataset (RADCOM). With CNN embeddings, CBR matches Random Forest accuracy (macro F1 of 0.923 versus 0.925 on CESNET) while training roughly ten times faster, adapts to new classes two to three orders of magnitude faster (seconds versus thousands of seconds), and detects out-of-distribution flows at up to 0.92 AUROC. The retrieval index is also far cheaper to keep resident than the baseline it replaces, holding 1.2 million CESNET flows in 171 MB against 1,350 MB for the serialized forest, because its size grows with the number of indexed flows rather than with the number of classes. The Random Forest remains the faster classifier per flow, so the trade-off is per-flow latency against adaptability and memory. These results show that retrieval-based classification is a practical and adaptable alternative for real-time encrypted traffic analysis in dynamic network environments.
```
@article{zion2026ultrafast,
  author = {Zion, Yehonatan and Dvir, Amit and Hajaj, Chen and Dubin, Ran and Filber, Neriya},
  title = {Ultra fast encrypted network traffic classification based on classification by retrieval powered by out-of-distribution},
  journal = {Computer Networks},
  year = {2026},
  doi = {10.1016/j.comnet.2026.112739},
  url = {https://doi.org/10.1016/j.comnet.2026.112739}
}
```
Quality of Experience Prediction for First Person Shooter Online Gaming: The Case Study of Call of Duty

Yehonatan Zion, Eyal Paz, Ran Dubin, Amit Dvir, and Chen Hajaj

ConferenceIEEE Consumer Communications & Networking Conference (CCNC) CORE B Student-led

DOI

Latency is the most impactful on fairness and Quality of Experience (QoE) in First-Person Shooter (FPS) games. High latency degrades the QoE of players, who may leave the game if unsatisfied with their QoE. Modern FPS games make great efforts to maintain an excellent QoE even under a poor Internet connection with high latency. Those efforts include the wide distribution of game servers and many software optimizations to smooth the effect of lags in the games. This study aims to provide insights into QoE estimation for network-intensive applications by examining one of the most prominent FPS games of the past two decades: Call of Duty. We observed that the game dynamically adjusts its network traffic behavior, including packet size and transmission rate, in response to variations in network quality. However, the ISP does not have this capability since the network traffic is encrypted; observing the game’s network traffic does not expose its nature and most certainly does not expose the game player’s intensity, latency, or QoE. We propose a novel technique for estimating latency and QoE in FPS games from an ISP-level perspective. In our evaluation, the model detected problematic latency in near real-time with 81% accuracy and an 80% F1 on a 10-second window, highlighting a trade-off between responsiveness and predictive performance. The dataset generated for this study is publicly available to support further research.
```
@inproceedings{zion2026qoe_fps_ccnc,
  author = {Zion, Yehonatan and Paz, Eyal and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  title = {Quality of Experience Prediction for First Person Shooter Online Gaming: The Case Study of Call of Duty},
  doi = {10.1109/CCNC65079.2026.11366349},
  booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
  year = {2026},
  month = jan,
  address = {Las Vegas, NV, USA},
  organization = {IEEE},
  month_numeric = {1}
}
```

FALCON: Few-shot ANN for Low-latency Classification in O-RAN Networks

Liav Cohen, Amit Dvir, and Chen Hajaj

ConferenceProceedings of the IEEE International Workshop on Computer-Aided Modeling and Design of Communication Links and Networks (CAMAD) Student-led

@inproceedings{cohen2026falcon,
  author = {Cohen, Liav and Dvir, Amit and Hajaj, Chen},
  title = {{FALCON}: Few-shot {ANN} for Low-latency Classification in {O-RAN} Networks},
  booktitle = {Proceedings of the IEEE International Workshop on Computer-Aided Modeling and Design of Communication Links and Networks (CAMAD)},
  year = {2026},
  note = {Session: AI-Driven 6G Cloud, O-RAN and Network Orchestration}
}

Selected: GraphMux: A graph-based framework for encrypted traffic classification

M. Klein, Revital Marbel, Chen Hajaj, Ran Dubin, and Amit Dvir

JournalComputer Networks SJR Q1

DOI Code

The growing dominance of encrypted network traffic and modern encryption protocols (TLS 1.3, QUIC, DoH) poses significant challenges for accurate network classification, particularly as many existing approaches rely on text- or image-based representations, which fail to adequately capture the inherent structural relationships present in network communication—relationships that are more naturally represented as graphs. In this work, we introduce GraphMux, a graph-based framework that leverages line graph transformations to fuse multiple graph views into a unified representation. We also present three graph-based flow representations (TIG+Chain, StarBurst, and 2Chain) designed to capture both temporal burst dynamics and client–server interaction patterns, using only packet time, direction, and length information, without incorporating any unencrypted statistical features. We evaluate our approach on three datasets: two academic datasets (UTMobileNetTraffic2021 and QUIC PCAP) and a commercial dataset (Flash), using four graph embedding architectures. Across all datasets, GraphMux consistently achieves superior performance, and the proposed graph constructions often yield the best results. Additional experiments examining attribute-selection strategies reveal a strong positive relationship between well-aligned feature assignments and classification accuracy, underscoring the importance of principled attribute design when constructing graph representations for encrypted traffic.
```
@article{klein2026graphmux,
  author = {Klein, M. and Marbel, Revital and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
  title = {GraphMux: A graph-based framework for encrypted traffic classification},
  journal = {Computer Networks},
  year = {2026},
  doi = {10.1016/j.comnet.2026.112370},
  url = {https://doi.org/10.1016/j.comnet.2026.112370}
}
```

2025

Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques

Yehonatan Zion, Porat Aharon, Ran Dubin, Amit Dvir, and Chen Hajaj

ConferenceIEEE International Conference on Communications (ICC) Student-led

DOI Code

The increasing popularity of online services has made Internet Traffic Classification a critical field of study. However, the rapid development of internet protocols and encryption limits usable data availability. This paper addresses the challenges of classifying encrypted Internet Traffic, focusing on the scarcity of open-source datasets and limitations of existing ones. We propose two Data Augmentation (DA) techniques to synthetically generate data based on real samples: Average augmentation and MTU augmentation. Both augmentations are aimed to improve the performance of the classifier, each from a different perspective: The Average augmentation aims to increase dataset size by generating new synthetic samples, while the M T U augmentation enhances classifier robustness to varying Maximum Transmission Units (MTUs). Our experiments, conducted on two well-known academic datasets and a commercial dataset, demonstrate the effectiveness of these approaches in improving model performance and mitigating constraints associated with limited and homogeneous datasets. Our findings underscore the potential of data augmentation in addressing the challenges of modern Internet Traffic classification. Specifically, we show that our augmentation techniques significantly enhance encrypted traffic classification models. This improvement can positively impact user Quality of Experience (QoE) by more accurately classifying traffic as video streaming (e.g., YouTube) or chat (e.g., Google Chat). Additionally, it can enhance Quality of Service (QoS) for file downloading activities (e.g., Google Docs).
```
@inproceedings{zion2025enhancing,
  title = {Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques},
  author = {Zion, Yehonatan and Aharon, Porat and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  booktitle = {IEEE International Conference on Communications (ICC)},
  series = {ICC},
  year = {2025},
  doi = {10.1109/icc52391.2025.11160885}
}
```
PQClass: Classification of Post-Quantum Encryption Applications in Internet Traffic

Angelos K. Marnerides, Chen Hajaj, Revital Marbel, Ran Dubin, and Amit Dvir

ConferenceIEEE International Conference on Communications (ICC)

DOI Code Explainer

Post-quantum cryptography (PQC) is expected to revolutionize secure communications in next-generation digital ecosystems. Previous and ongoing activities demonstrate that different PQC algorithms significantly impact traffic latency, but they do not yet provide a scheme to assess the existence of the PQC algorithm or its identification when encrypted traffic is analyzed for traffic engineering purposes. Hence, this work is the first to propose a novel PQClass pipeline for classifying encrypted Internet traffic of recently NIST-approved PQC algorithms. Hence, it establishes solid grounds for enabling engineers to optimize their networks and, in parallel, for cybersecurity practitioners to familiarise themselves with PQC algorithmic properties for enhancing or devising security architectures in diverse setups. Our pipeline demonstrates impressive performance on real-world data, achieving 86% accuracy in detecting the presence of a PQC algorithm and 91% and 98% accuracy in identifying the browser and OS, respectively, based on PQC-based traffic.
```
@inproceedings{marnerides2025pqclass,
  title = {PQClass: Classification of Post-Quantum Encryption Applications in Internet Traffic},
  author = {Marnerides, Angelos K. and Hajaj, Chen and Marbel, Revital and Dubin, Ran and Dvir, Amit},
  booktitle = {IEEE International Conference on Communications (ICC)},
  series = {ICC},
  year = {2025},
  doi = {10.1109/icc52391.2025.11160818}
}
```
Selected: A Classification-by-Retrieval Framework for Few-Shot Anomaly Detection to Detect API Injection

Udi Aharon, Ran Dubin, Amit Dvir, and Chen Hajaj

JournalComputers & Security SJR Q1 Student-led

DOI Code

Application Programming Interface (API) Injection attacks refer to the unauthorized or malicious use of APIs, which are often exploited to gain access to sensitive data or manipulate online systems for illicit purposes. Identifying actors that deceitfully utilize an API poses a demanding problem. Although there have been notable advancements and contributions in the field of API security, there remains a significant challenge when dealing with attackers who use novel approaches that don’t match the well-known payloads commonly seen in attacks. Also, attackers may exploit standard functionalities unconventionally and with objectives surpassing their intended boundaries. Thus, API security needs to be more sophisticated and dynamic than ever, with advanced computational intelligence methods, such as machine learning models that can quickly identify and respond to abnormal behavior. In response to these challenges, we propose a novel unsupervised few-shot anomaly detection framework composed of two main parts: First, we train a dedicated generic language model for API based on FastText embedding. Next, we use Approximate Nearest Neighbor search in a classification-by-retrieval approach. Our framework allows for training a fast, lightweight classification model using only a few examples of normal API requests. We evaluated the performance of our framework using the CSIC 2010 and ATRDF 2023 datasets. The results demonstrate that our framework improves API attack detection accuracy compared to the state-of-the-art (SOTA) unsupervised anomaly detection baselines.
```
@article{aharon2025classification,
  title = {A Classification-by-Retrieval Framework for Few-Shot Anomaly Detection to Detect API Injection},
  author = {Aharon, Udi and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  journal = {Computers \& Security},
  volume = {150},
  pages = {104249},
  year = {2025},
  publisher = {Elsevier Advanced Technology},
  doi = {10.1016/j.cose.2024.104249}
}
```
Selected: Out-Of-Distribution Is Not Magic: The Clash Between Rejection Rate and Model Success

Itay Meiri, Ran Dubin, Amit Dvir, and Chen Hajaj

ConferenceProceedings of the 20th Conference on Computer Science and Intelligence Systems (FedCSIS 2025)

DOI Code Explainer

Recent advancements in Internet protocols, including DNS over HTTPS (DoH) and Encrypted Service Name Indicators (ESNI), are making traditional Deep Packet Inspection (DPI) engines obsolete.Consequently, there is a growing need for nextgeneration traffic classification using artificial intelligence (AI).While DPI automatically categorizes unknown traffic as ’other,’ AI-based models cannot automatically handle unknown or Outof-Distribution (OOD) traffic.AI models must effectively detect and classify OOD traffic to ensure robustness, reliability, and accuracy in real-world applications; however, current research often fails to address the challenges of OOD detection.In this paper, we evaluate various state-of-the-art OOD detection techniques for internet traffic classification and explore the drawbacks and advantages of using different threshold levels for the model’s tolerance for OOD.Our findings reveal that varying rejection rates have distinct effects on OOD techniques, leading to a change in the optimal strategy for achieving dependable and precise detection across diverse OOD scenarios.We demonstrate that adjusting rejection rates from 10% to 30% can significantly improve the True Detection Rate (TDR) by up to 50%, while the False Detection Rate (FDR) may increase by less than 10%.Moreover, we emphasize that rejection-rate-based evaluation is pivotal for next-generation flow classification, promising a substantial reduction in FDR through rigorous methodological assessment.
```
@inproceedings{meiri2025outofdistribution,
  author = {Meiri, Itay and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  title = {Out-Of-Distribution Is Not Magic: The Clash Between Rejection Rate and Model Success},
  pages = {345--350},
  series = {Annals of Computer Science and Information Systems, vol. 43},
  booktitle = {Proceedings of the 20th Conference on Computer Science and Intelligence Systems (FedCSIS 2025)},
  year = {2025},
  doi = {10.15439/2025F5708},
  url = {https://doi.org/10.15439/2025F5708}
}
```

2024

Selected: The Art of Time-Bending: Data Augmentation and Early Prediction for Efficient Traffic Classification

Chen Hajaj, Porat Aharon, Ran Dubin, and Amit Dvir

JournalExpert Systems with Applications SJR Q1

DOI

The accurate identification of internet traffic is crucial for network management. However, the use of encryption techniques and constant changes in network protocols make it difficult to extract useful features for traffic classification. Additionally, there may be limited data availability and a lack of diversity within the dataset, which poses further challenges. To address these issues, our research proposes a novel solution that uses an innovative data augmentation technique. This approach leverages the capabilities of LSTM networks to create synthetic data points that closely resemble real traffic data. By doing so, we can significantly enrich the dataset used for training and improve classification efficiency. We conducted thorough experiments to validate our approach and found that combining LSTM-generated data with actual traffic data leads to notable improvements in classification efficiency. We demonstrated the effectiveness of our methodology using academic and commercial datasets. Our classifier, trained on the generated data, showed a performance boost of 6%. Moreover, when classifying with only half of the time, thus utilizing half of the signal, our approach achieved a notable 4% improvement compared to the original classifier. The inclusion of augmented samples within the training set led to a noticeable improvement in both accuracy and F1-score. These findings compellingly demonstrate our data augmentation strategy’s practical utility and efficiency in earlier prediction with improved performance for encrypted traffic classification systems.
```
@article{hajaj2024art,
  title = {The Art of Time-Bending: Data Augmentation and Early Prediction for Efficient Traffic Classification},
  author = {Hajaj, Chen and Aharon, Porat and Dubin, Ran and Dvir, Amit},
  journal = {Expert Systems with Applications},
  volume = {252},
  pages = {124166},
  year = {2024},
  publisher = {Elsevier},
  doi = {10.1016/j.eswa.2024.124166}
}
```
CBR–Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-Distribution

Amir Lukach, Ran Dubin, Amit Dvir, and Chen Hajaj

PreprintarXiv preprint arXiv:2403.11206

DOI

Encrypted network traffic Classification tackles the problem from different approaches and with different goals. One of the common approaches is using Machine learning or Deep Learning-based solutions on a fixed number of classes, leading to misclassification when an unknown class is given as input. One of the solutions for handling unknown classes is to retrain the model, however, retraining models every time they become obsolete is both resource and time-consuming. Therefore, there is a growing need to allow classification models to detect and adapt to new classes dynamically, without retraining, but instead able to detect new classes using few shots learning [1]. In this paper, we introduce Adaptive Classification By Retrieval CBR, a novel approach for encrypted network traffic classification. Our new approach is based on an ANN-based method, which allows us to effectively identify new and existing classes without retraining the model. The novel approach is simple, yet effective and achieved similar results to RF with up to 5% difference (usually less than that) in the classification tasks while having a slight decrease in the case of new samples (from new classes) without retraining. To summarize, the new method is a real-time classification, which can classify new classes without retraining. Furthermore, our solution can be used as a complementary solution alongside RF or any other machine/deep learning classification method, as an aggregated solution.
```
@misc{lukach2024cbr,
  title = {CBR--Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-Distribution},
  doi = {10.48550/arXiv.2403.11206},
  howpublished = {arXiv preprint arXiv:2403.11206},
  author = {Lukach, Amir and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  year = {2024}
}
```
OSF-EIMTC: An Open-Source Framework for Standardized Encrypted Internet Traffic Classification

Ofek Bader, Adi Lichy, Amit Dvir, Ran Dubin, and Chen Hajaj

JournalComputer Communications SJR Q1 Student-led

DOI Code

Internet traffic classification plays a key role in network visibility, Quality of Services (QoS), intrusion detection, Quality of Experience (QoE) and traffic-trend analyses. In order to improve privacy, integrity, confidentiality, and protocol obfuscation, the current traffic is based on encryption protocols, e.g., SSL/TLS. With the increased use of Machine-Learning (ML) and Deep-Learning (DL) models in the literature, comparison between different models and methods has become cumbersome and difficult due to a lack of a standardized framework. In this paper, we propose an open-source framework, named OSF-EIMTC, which can provide the full pipeline of the learning process. From the well-known datasets to extracting new and well-known features, it provides implementations of well-known ML and DL models (from the traffic classification literature) as well as evaluations. Such a framework can facilitate research in traffic classification domains, so that it will be more repeatable, reproducible, easier to execute, and will allow a more accurate comparison of well-known and novel features and models.
```
@article{bader2024osf,
  title = {OSF-EIMTC: An Open-Source Framework for Standardized Encrypted Internet Traffic Classification},
  author = {Bader, Ofek and Lichy, Adi and Dvir, Amit and Dubin, Ran and Hajaj, Chen},
  journal = {Computer Communications},
  volume = {213},
  pages = {271--284},
  year = {2024},
  publisher = {Elsevier},
  doi = {10.1016/j.comcom.2023.10.011}
}
```
Hidden in Time, Revealed in Frequency: Spectral Features and Multiresolution Analysis for Encrypted Internet Traffic Classification

Nathan Dillbary, Roi Yozevitch, Amit Dvir, Ran Dubin, and Chen Hajaj

ConferenceIEEE Consumer Communications & Networking Conference (CCNC) CORE B Student-led

DOI Code

In recent years, privacy and security concerns have led to the wide adoption of encrypted protocols, making encrypted traffic a major portion of overall communications online. The transition into more secure protocols poses significant challenges for internet service providers to utilize traditional traffic classification techniques in order to guarantee the Quality of Service (QoS), Quality of Experience (QoE), and cyber-security of their customers. In this work, we introduce two methods, namely STFT-TC and DWT-TC, leveraging compact time-series representation coupled with well-known techniques from the field of Digital Signal Processing (DSP): the short-time Fourier transform (STFT) and the discrete wavelet transform (DWT). The STFT-TC method extracts a suite of statistical and spectral features from the magnitude spectrogram, offering a fresh perspective on interpreting and classifying encrypted traffic. The DWT-TC method extracts statistical features from the wavelet coefficients and incorporates unique characteristics that describe the signal’s shape and energy distribution. Evaluating our methods on two public QUIC datasets demonstrated improvements in accuracy of up to 5.7%. Similarly, the F1-scores also showed enhancements, with increments of up to 5.9% for the same datasets.
```
@inproceedings{dillbary2024hidden,
  title = {Hidden in Time, Revealed in Frequency: Spectral Features and Multiresolution Analysis for Encrypted Internet Traffic Classification},
  author = {Dillbary, Nathan and Yozevitch, Roi and Dvir, Amit and Dubin, Ran and Hajaj, Chen},
  booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
  pages = {266--271},
  year = {2024},
  organization = {IEEE},
  doi = {10.1109/ccnc51664.2024.10454807}
}
```

Revolutionizing Our Way to Better Classifiers: Leveraging Synthetic Data with Generative Models for Encrypted Network Traffic Classification

Yehonatan Zion, Chen Hajaj, Amit Dvir, Gil Ben-Artzi, Shahar Mahpod, and Ran Dubin

PreprintSSRN preprint 4654236 Student-led

DOI

@misc{zion4654236revolutionizing,
  title = {Revolutionizing Our Way to Better Classifiers: Leveraging Synthetic Data with Generative Models for Encrypted Network Traffic Classification},
  howpublished = {SSRN preprint 4654236},
  author = {Zion, Yehonatan and Hajaj, Chen and Dvir, Amit and Ben-Artzi, Gil and Mahpod, Shahar and Dubin, Ran},
  year = {2024},
  doi = {10.2139/ssrn.4654236}
}

2023

When a RF Beats a CNN and GRU, Together—A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification

Adi Lichy, Ofek Bader, Ran Dubin, Amit Dvir, and Chen Hajaj

JournalComputers & Security SJR Q1 Student-led

DOI Code Explainer

Internet traffic classification is widely used to facilitate network management. It plays a crucial role in Quality of Services (QoS), Quality of Experience (QoE), network visibility, intrusion detection, and traffic trend analyses. While there is no theoretical guarantee that deep learning (DL)-based solutions perform better than classic machine learning (ML)-based ones, DL-based models have become the common default. This paper compares well-known DL-based and ML-based models and shows that in the case of malicious traffic classification, state-of-the-art DL-based solutions do not necessarily outperform the classical ML-based ones. We exemplify this finding using two well-known datasets for a varied set of tasks, such as: malware detection, malware family classification, detection of zero-day attacks, and classification of an iteratively growing dataset. Note that, it is not feasible to evaluate all possible models to make a concrete statement, thus, the above finding is not a recommendation to avoid DL-based models, but rather empirical proof that in some cases, there are more simplistic solutions, that may perform even better.
```
@article{lichy2023rf,
  title = {When a RF Beats a CNN and GRU, Together---A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification},
  author = {Lichy, Adi and Bader, Ofek and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  journal = {Computers \& Security},
  volume = {124},
  pages = {103000},
  year = {2023},
  publisher = {Elsevier Advanced Technology},
  doi = {10.1016/j.cose.2022.103000}
}
```

2022

SimCSE for Encrypted Traffic Detection and Zero-Day Attack Detection

Rotem Bar and Chen Hajaj

JournalIEEE Access SJR Q1 Student-led

DOI

Traffic detection has attracted much attention in recent years, playing an essential role in intrusion detection systems (IDS). This paper proposes a new approach for traffic detection at the packet level, inspired by natural language processing (NLP), using simple contrastive learning of sentence embeddings (SimCSE) as an embedding model. The new approach can learn the features of traffic from raw packet data. Experiments were conducted on two well-known datasets to evaluate our approach. For detecting malicious activity, our model achieved an accuracy of 99.99% on the USTC-TFC2016 dataset, whereas for detecting virtual private network (VPN) activity, our model achieved an accuracy of 99.98% on the ISCXVPN2016 dataset. Furthermore, the resulting model was found to be robust based on zero-day attack detection, which shows the model’s ability to detect attacks that have not been seen before. Experiments show that our approach can effectively detect network traffic and outperforms many other state-of-the-art methods.
```
@article{bar2022simcse,
  title = {SimCSE for Encrypted Traffic Detection and Zero-Day Attack Detection},
  author = {Bar, Rotem and Hajaj, Chen},
  journal = {IEEE Access},
  volume = {10},
  pages = {56952--56960},
  year = {2022},
  publisher = {IEEE},
  doi = {10.1109/access.2022.3177272}
}
```
MalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification

Ofek Bader, Adi Lichy, Chen Hajaj, Ran Dubin, and Amit Dvir

ConferenceIEEE Consumer Communications & Networking Conference (CCNC) CORE B Student-led

DOI

The world of malware is shifting towards using encrypted traffic. While encryption improves the privacy of users, it brings challenges in the fields of QoS, QoE, and cybersecurity. Recent state-of-the-art Deep-Learning architectures for encrypted traffic classifications demonstrated superb results in tasks of traffic categorization over encrypted traffic. In this paper, we leverage the feasibility to use such architectures for the tasks of malware detection and classification to gain insights into how well these architectures perform in the domain of malware traffic. Specifically, we present a Deep-Learning model for malware traffic detection and classification (MalDIST), which outperforms both classical ML and DL malware traffic classification models both in terms of detection and classification.
```
@inproceedings{bader2022maldist,
  title = {MalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification},
  author = {Bader, Ofek and Lichy, Adi and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
  booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
  pages = {527--533},
  year = {2022},
  organization = {IEEE},
  doi = {10.1109/ccnc49033.2022.9700625}
}
```

2021

PCL: Packet Classification with Limited Knowledge

Vitalii Demianiuk, Chen Hajaj, and Kirill Kogan

ConferenceIEEE Conference on Computer Communications (INFOCOM) CORE A*

DOI

We introduce a novel representation of packet classifiers allowing to operate on partially available input data varying dynamically. For a given packet classifier, availability of fields or complexity of field computations, and free target specific resources, the proposed infrastructure computes a classifier representation satisfying performance and robustness requirements. We show the feasibility to reconstruct a classification result in this noisy environment, allowing for the improvement of performance and the achievement of additional robustness levels of network infrastructure. Our results are supported by extensive evaluations in various settings where only a partial input is available.
```
@inproceedings{demianiuk2021pcl,
  title = {PCL: Packet Classification with Limited Knowledge},
  author = {Demianiuk, Vitalii and Hajaj, Chen and Kogan, Kirill},
  booktitle = {IEEE Conference on Computer Communications (INFOCOM)},
  pages = {1--10},
  year = {2021},
  organization = {IEEE},
  doi = {10.1109/infocom42981.2021.9488751}
}
```

2020

Encrypted Video Traffic Clustering Demystified

Amit Dvir, Angelos K. Marnerides, Ran Dubin, Nehor Golan, and Chen Hajaj

JournalComputers & Security SJR Q1

DOI

Cyber threat intelligence officers and forensics investigators often require the behavioural profiling of groups based on their online video viewing activity. It has been demonstrated that encrypted video traffic can be classified under the assumption of using a known subset of video titles based on temporal video viewing trends of particular groups. Nonetheless, composing such a subset is extremely challenging in real situations. Therefore, this work exhibits a novel profiling scheme for encrypted video traffic with no a priori assumption of a known subset of titles. It introduces a seminal synergy of Natural Language Processing (NLP) and Deep Encoder-based feature embedding algorithms with refined clustering schemes from off-the-shelf solutions, in order to group viewing profiles with unknown video streams. This study is the first to highlight the most computationally effective, accurate combinations of feature embedding and clustering using real datasets, thereby, paving the way to future forensics tools for automated behavioural profiling of malicious actors.
```
@article{dvir2020encrypted,
  title = {Encrypted Video Traffic Clustering Demystified},
  author = {Dvir, Amit and Marnerides, Angelos K. and Dubin, Ran and Golan, Nehor and Hajaj, Chen},
  journal = {Computers \& Security},
  volume = {96},
  pages = {101917},
  year = {2020},
  publisher = {Elsevier Advanced Technology},
  doi = {10.1016/j.cose.2020.101917}
}
```
Robust Machine Learning for Encrypted Traffic Classification

Jonathan Muehlstein, Yehonatan Zion, Ofir Pele, Chen Hajaj, Ran Dubin, and Amit Dvir

PreprintarXiv preprint (CoRR)

Desktops and laptops can be maliciously exploited to violate privacy. In this paper, we consider the daily battle between the passive attacker who is targeting a specific user against a user that may be adversarial opponent. In this scenario, while the attacker tries to choose the best vector attack by surreptitiously monitoring the victims encrypted network traffic in order to identify users parameters such as the Operating System (OS), browser and apps. The user may use tools such as a Virtual Private Network (VPN) or even change protocols parameters to protect his/her privacy. We provide a large dataset of more than 20,000 examples for this task. We run a comprehensive set of experiments, that achieves high (above 85) classification accuracy, robustness and resilience to changes of features as a function of different network conditions at test time. We also show the effect of a small training set on the accuracy.
```
@misc{muehlstein2020robust,
  title = {Robust Machine Learning for Encrypted Traffic Classification},
  howpublished = {arXiv preprint (CoRR)},
  author = {Muehlstein, Jonathan and Zion, Yehonatan and Pele, Ofir and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
  year = {2020}
}
```

Work on this

The lab takes on PhD and MSc students and works with academic and industry partners on this line of research. Write with a short note on your background and what you would like to work on.

Email Chen about this project Code and datasets