TPIPD: A Robust Model for Online VPN Traffic Classification

VPN has posed many difficulties for network security management. In this paper, we develop a robust method to classify the VPN traffic. Firstly, we investigate the VPN transmission process and find the turning packet interval (Named as TPI) is a valuable feature for VPN traffic classification. Then we employ the probability distribution of TPI to improve the robustness of classification process, which is named as TPIPD. Secondly, we evaluate our method using the ISCXVPN2016 dataset and find our method has higher classification accuracy compared with other related methods. We also find the distribution of the first few TPIs can be used to represent that of the entire TPIs of specific flow, thus our method can be used for online traffic classification. As TPIPD is a kind of probability feature, it is more robust than other traditional features. Finally, the experiments verify our methods can be used for mice flow identification.