Shedding Light in the Tunnel: Counting Flows in Encrypted Network Traffic

Network traffic analysis helps experts to under-stand the behavior of communication networks. By exploiting information from packet headers and payloads, ML has been also widely applied to extend the capabilities of traditional statistical approaches. However, modern traffic encryption hampers network traffic analysis, especially in the case of VPNs when multiple flows are encrypted and transported concurrently. An initial step toward extracting information from encrypted traffic is to discover the number of flows that coexist in an aggregated and encrypted data stream. In this paper we propose a technique for disclosing the number of flows aggregated and sent together via encrypted tunnels. We use LSTM cells to learn the relation between the number of flows and the different temporal combinations from available attributes regardless of encryption. Results indicate that predicting the number of flows in encrypted tunnels with a relatively small error is surprisingly possible, providing the basis for a wide range of future research.