Entropy Estimation for Real-Time Encrypted Traffic Identification
Paper in proceeding, 2011

This paper describes a novel approach to classify network traffic into encrypted and unencrypted traffic. The classifier is able to operate in real-time as only the first packet of each flow is processed. The main metric used for classification is an estimation of the entropy of the first packet payload. The approach is evaluated based on encrypted ground truth traces and on real network traces. Encrypted traffic such as Skype, or encrypted eDonkey traffic are detected as encrypted with probability higher than 94%. Unencrypted protocols such as SMTP, HTTP, POP3 or FTP are detected as unencrypted with probability higher than 99.9%. The presented approach, named real-time encrypted traffic detector (RT-ETD), is well suited to operate as pre-filter for advanced classification approaches to enable their applicability on increased bandwidth.

entropy estimation

real-time detection

traffic filtering


Peter Dorfinger

Salzburg Research Forschungsgesellschaft mbH

Georg Panholzer

Salzburg Research Forschungsgesellschaft mbH

Wolfgang John

Chalmers, Computer Science and Engineering (Chalmers), Networks and Systems (Chalmers)

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

03029743 (ISSN) 16113349 (eISSN)

Vol. 6613 164-171
978-3-642-20304-6 (ISBN)

Subject Categories

Computer Engineering


Areas of Advance

Information and Communication Technology





More information