Classification of applications in HTTP tunnels

Accurate traffic classification is an essential element of emergent cloud and datacenter architectures. Increasingly, however, different types of application traffic from the cloud are tunnelled over HTTP, thereby making accurate classification a challenge. Applications tunnelled over HTTP are wide in scope and diverse in nature, and include mapping, email, video, image, audio and file. This paper presents a novel approach for the accurate and effective classification of the dominant types of HTTP tunnelled applications, namely video, audio and file-transfer. The classification is carried out using information that is only available from flow-based protocols such as NetFlow v5. The proposed scheme is tested on live data traffic in a small enterprise network with a realistic mixture of regular HTTP and non-HTTP traffic. Outsourcing enterprise networks to cloud is a major cloud application. For the scenarios tested, the proposed algorithm accurately classifies at least 70% of the HTTP tunnelled traffic, and in some cases, up to 90%. In comparison to the results from approaches based on NaiveBayes algorithm and Support-Vector-Machine, the proposed scheme outperforms them by at least 10% as per performance measures.