An empirical study of morphing on network traffic classification

Abstract

Network morphing aims at masking traffic to degrade the performance of traffic identification and classification. Several morphing strategies have been proposed as promising approaches, very few works, however, have investigated their impact on the actual traffic classification performance. This work sets out to fulfill this gap from an empirical study point of view. It takes into account different morphing strategies exerted on packet size and/or inter-arrival time. The results show that not all morphing strategies can effectively obfuscate traffic classification. Different morphing strategies perform distinctively, among which the integration of packet size and inter arrival time morphing is the best, and the packet size based method is the worst. The three classifiers also exhibit distinct robustness to the morphing, with C4.5 being the most robust and Naive Bayes being the weakest. In addition, our study shows that classifiers can learn nontrivial information merely from the traffic direction patterns, which partially explains the weakness of packet size based morphing methods.