Abstract: With the development of encryption technologies and the emergence of private protocols, the identification of encrypted traffic has become an important research area in the field of information security. Based on the research of existing encrypted traffic identification technologies, an encrypted traffic identification algorithm based on DPI (deep packet inspection) and load randomness is proposed in this paper. The proposed algorithm mainly contains three steps. First, the DPI is used to filter and identify network traffic rapidly. Second, for those payload which could not be recognized by the DPI, their information entropies are calculated and the error of π-value is computed by Monte Carlo simulation. Finally, the C4.5 decision tree classifier is input for classification evaluation. The method can not only overcome the limitation that DPI can't fully identify the encrypted traffic and private protocol in the protocol interaction phase, but also solve the mis-distinguish of encrypted traffic and compressed file traffic as employing information entropy independently. Experimental results show that the proposed method is much more effective on encrypted traffic than the existing methods. At the same time, the method is proved to have good robustness.

Key words: encrypted traffic, deep packet inspection(DPI), information entropy, Monte Carlo simulation, C4.5 decision tree