Research Article

ETCC: Encrypted Two-Label Classification Using CNN

Table 1

Features details.

FeatureDescription

IP{Source IP, destination IP}
Port{Source port, destination port}
ProtocolThe protocol of the flow
Flow durationThe duration of the flow
PacketTotal packets in the {forward, backward} direction
Length of packet{Total, max, min, mean, std} size of packet in {forward, backward} direction
Flow packet length{Max, min, mean, std, variance} length of a flow
Flow bytes/s# of bytes transferred per second
Flow packets/s# of packets transferred per second
Packets/s# of {forward, backward} packets per second
Flow IAT{Max, min, mean, std} time between two flows
Forward IAT{Total, max, min, mean, std} time between two packets sent in the forward direction
Backward IAT{Total, max, min, mean, std} time between two packets sent in the backward direction
Flags# of times the {PSH, URG} flag was set in packets travelling in the {forward, backward} direction (0 for UDP)
Flag count# of packets with {FIN, SYN, RST, PSH, ACK, URG, CWE, ECE}
Header lengthTotal bytes used for headers in the {forward, backward} direction
Ratio{Down, up} ratio
Average packet sizeAverage size of packet
Segment size avgAverage size observed in the {flow, forward, backward} direction
Bytes/Bulk avgAverage number of bytes bulk rate in the {forward, backward} direction
Packet/Bulk avgAverage number of packets bulk rate in the {forward, backward} direction
Bulk rate avgAverage number of bulk rate in the {forward, backward} direction
Subflow packetsThe average number of packets in a subflow in the {forward, backward} direction
Subflow bytesThe average number of bytes in a subflow in the {forward, backward} direction
Init win bytes# of bytes sent in initial window in the {forward, backward} direction
Forward Act data pkts# of packets with at least 1 byte of TCP data payload in the forward direction
Forward seg size minMinimum segment size observed in the forward direction
Active time{Mean, max, min, std} time a flow was active before becoming idle
Idle time{Mean, max, min, std} time a flow was idle before becoming active