Encrypted Traffic Identification Based on N-gram Entropy and Cumulative Sum Test

Since existing methods using entropy are less effective in characterizing encrypted traffic, this paper proposes an encrypted traffic identification method based on n-gram entropy and cumulative sum. This method analyzes the entropy characteristics of n-gram entropy for text, picture, compressed file, and encrypted traffic in the network. Furthermore, an analysis of cumulative sum is performed to better distinguish compressed file traffic and encrypted traffic. The experiments show that our propsed method reaches high accuracy for encrypted traffic identification and performs well in distinguishing compressed file traffic and encrypted traffic.