Real-Time Encrypted Traffic Classification in Programmable Networks with P4 and Machine Learning

Abstract

Network traffic encryption has been on the rise in recent years, making encrypted traffic classification (ETC) an important area of research. Machine learning (ML) methods for ETC are widely regarded as the state of the art. However, most existing solutions either rely on offline ETC based on collected network data or on online ETC with models running in the control plane of software-defined networks, all of which do not run at line rate and would not meet the strict requirements of ultra-low-latency applications in modern networks. This work exploits recent advances in data plane programmability to achieve real-time ETC in programmable switches at line rate, with high throughput and low latency. An extensive analysis is first conducted to show how tree-based models excel in ETC on various datasets. Then, a workflow is proposed for in-switch ETC with tree-based models. The proposed workflow builds on (i) an ETC-aware random forest (RF) modelling process where only features based on packet size and packet arrival times are used and (ii) an encoding of the trained RF model into off-the-shelf P4-programmable switches. The performance of the proposed in-switch ETC solution is evaluated on three use cases based on publicly available encrypted traffic datasets. Experiments are then conducted in a real-world testbed with Intel Tofino switches, in the presence of high-speed background traffic. Results show how the solution achieves high classification accuracy of up to 95% in QUIC traffic classification, with submicrosecond delay while consuming less than 10% on average of the total hardware resources available on the switch.