ETD

• classification
• clustering
• fingerprint
• mobile applications
• network traffic

Network traffic classification is the task of identifying and categorising traffic generated by a monitored network into a number of classes, depending on applications, protocols or services appearing in the observed communications. This type of analysis is relevant in order to better understand the behaviour of the connected devices, to provide the agreed-upon level of QoS, and to detect potential malicious traffic or attacks. Current challenges of the subject matter involve the ability to recognise encrypted network traffic, as well as NAT and VPN communications.
This work proposes an approach to the classification of mobile application traffic into a set of clusters, with the goal of identifying the different software installed on the monitored devices and provide information about the network’s behaviour. The method consists in an algorithm leveraging notions of similarity to cluster together flows, requiring no machine learning or training phase.