A systematic approach of feature selection for encrypted network traffic classification

In this paper we present a statistical analysis technique for classifying encrypted network traffic. The technique uses the fast orthogonal search (FOS) algorithm to select a subset of features with discriminative power from a large set of features derived from the data. A k-nearest neighbor (kNN) classifier was then used to classify the network traffic using the features selected by FOS. The FOS algorithm selected a 12-feature subset from a set of 2,839 features. A kNN classifier using these 12 features has 106 fewer errors than a kNN using an arbitrary 44-feature set and there was an 81% reduction in computation time for classification.