A decision theory based tool for detection of encrypted WebRTC traffic

The detection of encrypted streamed traffic (like VoIP or Video) is an increasingly important issue for authorities involved in lawful interception. Aside from well established technologies like Skype, Facetime and MSN Messenger a new one is recently spreading: Web Real-Time Communication (WebRTC), which, with the support of powerful encryption methods as DTLS, offers capabilities for encrypted streaming voice and video without the need of installing a specific application but using a common browser like Chrome, Firefox or Opera. WebRTC traffic cannot be detected through methods of semantic recognition since it does not exhibit a distinguishable sequence of information pieces and hence statistical recognition methods are called for. In this paper we propose and evaluate a decision theory based system allowing to recognize encrypted WebRTC traffic by means of an open-source machine learning environment: Weka.