Research Article

Preprocessing Method for Encrypted Traffic Based on Semisupervised Clustering

Table 2

Top 20 features.

Feature description

Proportion of payload ratio in [200, 400) to the total0.5381
Proportion of payload ratio in [8, 10) to the total0.5421
Proportion of in-payload size in [0, 2) kB to the total0.5433
Proportion of payload ratio in [30, 40) to the total0.5436
Proportion of out-payload size in [20, 40) kB to the total0.5451
Proportion of in-payload size in [40000, 45000) kB to the total0.5473
Proportion of in-payload size in [25000, 30000) kB to the total0.5531
Proportion of payload ratio in [150, 200) to the total0.5553
Proportion of in-payload size in [450, 500) kB to the total0.5558
Proportion of in-payload size in [1500, 2000) kB to the total0.5572
Proportion of payload ratio in [500, 1000) to the total0.5575
If the communication frequency in [20, 40)0.5642
Proportion of payload ratio in [6, 8) to the total0.5656
Proportion of in-payload size in [45000, 50000) kB to the total0.5663
Proportion of out-payload size in [16, 18) kB to the total0.5664
If the communication frequency in [200, 400)0.5670
Proportion of out-payload size in [90, 100) kB to the total0.5704
If the communication frequency in [70, 80)0.5726
Proportion of payload ratio in [18, 20) to the total0.5735
Proportion of in-payload size in [50, 60) kB to the total0.5738