Encrypted Network Traffic Feature Extraction for Application Classification

As network traffic increasingly becomes encrypted, traditional traffic classification methods based on payload signatures are facing significant limitations. Although various approaches have been proposed to address this issue, they often encounter challenges such as suboptimal performance, extended processing time, and overfitting due to dataset-specific characteristics, making them impractical for real-world deployment. In particular, methods relying on the payload area for encrypted traffic classification are inherently constrained. To overcome these limitations, this paper proposes a classification method that leverages "Burst" characteristics—temporal patterns in encrypted traffic—to identify the application responsible for generating the traffic.