关键词: 加密流量分析, DBSCAN, 随机森林

Abstract:

With the rapid development of smart mobile terminals and the increasing variety of mobile applications, the identification of mobile application has become an important technology in the fields of network management, marketing and network attack prevention. Actually, almost all mobile applications use the SSL/TLS（Secure Sockets Layer/Transport Layer Security） protocol to encrypt data, making the identification of mobile application more challenging. This paper proposes a novel methodology for the identification of Android Apps from their encrypted network traffic. The method employs the information entropy to analyze the clusters generated by the DBSCAN（Density-Based Spatial Clustering of Applications with Noise） clustering algorithm, and filters the noise samples in the dataset by experimentally setting the entropy threshold. Finally, the classifier is trained by feeding the filtered dataset to the random forest algorithm. Since this method implements application identification only by capturing the transmission pattern of encrypted flow, it is effective for both encrypted and non-encrypted traffic. Experiments show that the methodology alleviates the misjudgment of noise samples, effectively improves the dataset utilization, and has higher recognition accuracy and recall rate.

Key words: encrypted traffic analysis, DBSCAN, random forest