Analyzing Encrypted Facebook Traffic

点击翻译按钮获取中文摘要

Accurate network traffic identification would assist network operations and management teams effectively on many different network tasks such as managing bandwidth and ensuring security. The demand for bandwidth management methods that optimize network performance and provide quality of service (QoS) guarantees has increased substantially in recent years. As new social networking and peer-to-peer (P2P) applications such as Facebook and Skype have dramatically grown in popularity over the past few years, they now constitute a significant share of the total traffic in many networks. Therefore, identification of such network traffic plays an important role in many areas such as traffic engineering, QoS, security and so on. In this research, we aim to investigate how encrypted Facebook traffic can be accurately and rapidly identified from observing the statistical properties of a small sequence of packet attributes. Indeed, covering a collection of different encrypted behaviors makes it difficult to distinguish Facebook from non-Facebook traffic. Moreover, being in encrypted tunnels, it is challenging to predict what kind of a Facebook communication (e.g. voice, chat or video) is used in the encrypted Facebook traffic without decrypting the traffic. Thus, the goal of this research is to develop a model that not only distinguishes Facebook traffic from non-Facebook traffic on the network, but also is able to separate Facebook traffic into chat, voice and video components without decrypting it.