Grano-GT: A granular ground truth collection tool for encrypted browser-based Internet traffic

Zaki, Faiz; Gani, Abdullah; Tahaei, Hamid; Furnell, Steven; Anuar, Nor Badrul

Abstract

© 2020 Modern network traffic classification puts much attention toward producing a granular classification of the traffic, such as at the application service level. However, the classification process is often impaired by the lack of granular network traffic ground truth. Granular network traffic ground truth is critical to provide a benchmark for a fair evaluation of modern network traffic classification. Nevertheless, in modern network traffic classification, existing ground truth tools only managed to build the ground truth at the application name level at most. Application name level granularity is quickly becoming insufficient to address the current needs of network traffic classification and therefore; this paper presents the design, development and experimental evaluation of Grano-GT, a tool to build a reliable and highly granular network traffic ground truth for encrypted browser-based traffic at the application name and service levels. Grano-GT builds on four main engines which are packet capture, browser, application and service isolator engines. These engines work together to intercept the application requests and combine them with the support of temporal features and cascading filters to produce reliable and highly granular ground truth. Preliminary experimental results show that Grano-GT can classify the Internet traffic into respective application names with high reliability. Grano-GT achieved an average accuracy of more than 95% when validated using nDPI at the application name level. The remaining 5% loss of accuracy was primarily due to the unavailability of signatures in nDPI. In addition, Grano-GT managed to classify application service traffic with significant reliability and validated using the Kolmogorov-Smirnov test.

Citation

Zaki, F., Gani, A., Tahaei, H., Furnell, S., & Anuar, N. B. (2021). Grano-GT: A granular ground truth collection tool for encrypted browser-based Internet traffic. Computer Networks, 184, Article 107617. https://doi.org/10.1016/j.comnet.2020.107617

• Journal Article Type: Article
• Acceptance Date: Oct 14, 2020
• Online Publication Date: Oct 17, 2020
• Publication Date: Jan 15, 2021
• Deposit Date: Oct 15, 2020
• Publicly Available Date: Oct 18, 2021
• Journal: Computer Networks
• Print ISSN: 1389-1286
• Publisher: Elsevier
• Peer Reviewed: Peer Reviewed
• Volume: 184
• Article Number: 107617
• DOI: https://doi.org/10.1016/j.comnet.2020.107617
• Keywords: Ground truth; network traffic classification; granular
• Public URL: https://nottingham-repository.worktribe.com/output/4965169
• Publisher URL: https://www.sciencedirect.com/science/article/abs/pii/S1389128620312482