{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T14:37:14Z","timestamp":1775054234358,"version":"3.50.1"},"publisher-location":"Cham","reference-count":37,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319298139","type":"print"},{"value":"9783319298146","type":"electronic"}],"license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016]]},"DOI":"10.1007\/978-3-319-29814-6_23","type":"book-chapter","created":{"date-parts":[[2016,3,7]],"date-time":"2016-03-07T09:04:46Z","timestamp":1457341486000},"page":"282-294","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["An Entropy Based Encrypted Traffic Classifier"],"prefix":"10.1007","author":[{"given":"Mohammad Saiful Islam","family":"Mamun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ali A.","family":"Ghorbani","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Natalia","family":"Stakhanova","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,3,5]]},"reference":[{"issue":"3","key":"23_CR1","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1109\/SURV.2009.090304","volume":"11","author":"Arthur Callado","year":"2009","unstructured":"Callado, A., et al.: A Survey on Internet Traffic Identification. IEEE Commun. Surveys Tutorials, 11(3), 37\u201352 (2009)","journal-title":"IEEE Communications Surveys & Tutorials"},{"issue":"6","key":"23_CR2","doi-asserted-by":"publisher","first-page":"1326","DOI":"10.1016\/j.comnet.2010.12.002","volume":"55","author":"R Alshammari","year":"2011","unstructured":"Alshammari, R., Nur Zincir-Heywood, A.: Can encrypted traffic be identified without port numbers. Computer networks 55(6), 1326\u20131350 (2011)","journal-title":"Computer networks"},{"key":"23_CR3","doi-asserted-by":"crossref","unstructured":"Alshammari, R., Nur Zincir-Heywood, A.: Investigating two different approaches for encrypted traffic classification. Privacy, Security and Trust (2008)","DOI":"10.1109\/PST.2008.15"},{"issue":"3","key":"23_CR4","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","volume":"27","author":"CE Shannon","year":"1948","unstructured":"Shannon, C.E.: A mathematical theory of communication. Bell Syst. Tech. J. 27(3), 379\u2013423 (1948)","journal-title":"Bell Syst. Tech. J."},{"issue":"9","key":"23_CR5","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/0898-1221(93)90001-C","volume":"26","author":"G Marsaglia","year":"1993","unstructured":"Marsaglia, G., Zaman, A.: Monkey tests for random number generators. Comput. Math. Appl. 26(9), 1\u201310 (1993)","journal-title":"Comput. Math. Appl."},{"key":"23_CR6","unstructured":"jNetPcap, Open-source java library. http:\/\/jnetpcap.com"},{"key":"23_CR7","unstructured":"Datasets: Information Security Center of eXcellence (ISCX). www.unb.ca\/research\/iscx\/dataset\/"},{"key":"23_CR8","unstructured":"Tstat, Skype Testbed Traces. http:\/\/tstat.tlc.polito.it\/traces-skype.shtml"},{"key":"23_CR9","unstructured":"Wireshark sample captures. http:\/\/wiki.wireshark.org\/SampleCaptures"},{"key":"23_CR10","unstructured":"Schneider, P.: TCP\/IP traffic Classification Based on port numbers. Division Of Applied Sciences, Cambridge, 2138 (1996)"},{"key":"23_CR11","doi-asserted-by":"crossref","unstructured":"Karagiannis, T., Papagiannaki, K., Faloutsos, M.: BLINK: multilevel traffic classification in the dark. In: SIGCOMM , Philadelphia, 21\u201326 August 2005","DOI":"10.1145\/1080091.1080119"},{"key":"23_CR12","doi-asserted-by":"crossref","unstructured":"Moore, A.W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. In: SIGMETRIC, Banff, 6\u201310 June 2005","DOI":"10.1145\/1064212.1064220"},{"key":"23_CR13","doi-asserted-by":"crossref","unstructured":"Sen, S., Spatscheck, O., Wang, D.: Accurate, scalable in-network identification of P2P traffic using application signatures. In: WWW2005, USA (2004)","DOI":"10.1145\/988672.988742"},{"key":"23_CR14","doi-asserted-by":"crossref","unstructured":"Zander, S., Nguyen, T., Armitage, G.: Automated traffic classification and application identification using machine learning. In: LCN, Australia (2005)","DOI":"10.1109\/LCN.2005.35"},{"key":"23_CR15","doi-asserted-by":"crossref","unstructured":"Gomes, J.V., et al.: Analysis of peer-to-peer traffic using a behavioural method based on entropy. In: Performance, Computing and Communications Conference (2008)","DOI":"10.1109\/PCCC.2008.4745138"},{"issue":"4","key":"23_CR16","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1145\/1282427.1282386","volume":"37","author":"Dario Bonfiglio","year":"2007","unstructured":"Bonfiglio, D., et al.: Revealing skype traffic: when randomness plays with you. In: Proceedings of the ACM SIGCOMM, pp. 37\u201348. ACM Press, USA (2007)","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"23_CR17","doi-asserted-by":"crossref","unstructured":"Smith, R., et al.: Deflating the big bang: fast and scalable deep packet inspection. In: ACM SIGCOMM , pp. 207\u2013218. ACM Press, USA (2008)","DOI":"10.1145\/1402946.1402983"},{"key":"23_CR18","doi-asserted-by":"crossref","unstructured":"Zhang, H., Papadopoulos, C., Massey, D.: Detecting encrypted botnet traffic. In: Computer Communications Workshops (INFOCOM Workshop). IEEE (2013)","DOI":"10.1109\/INFCOM.2013.6567180"},{"key":"23_CR19","doi-asserted-by":"crossref","unstructured":"Dorfinger, P., et al.: Entropy-based traffic filtering to support real-time Skype detection. In: Proceedings of the 6th International Wireless Communications and Mobile Computing Conference. ACM (2010)","DOI":"10.1145\/1815396.1815568"},{"key":"23_CR20","doi-asserted-by":"crossref","unstructured":"Korczynski, M., Duda, A.: Markov chain fingerprinting to classify encrypted traffic. In: INFOCOM, Proceedings IEEE. IEEE (2014)","DOI":"10.1109\/INFOCOM.2014.6848005"},{"key":"23_CR21","unstructured":"Sun, Q., et al.: Statistical identification of encrypted web browsing traffic. In: IEEE Symposium on Security and Privacy, Proceedings. IEEE (2002)"},{"key":"23_CR22","unstructured":"Weber, M., et al.: A toolkit for detecting and analyzing malicious software. In: 18th Annual Proceedings of Computer Security Applications Conference. IEEE (2002)"},{"key":"23_CR23","doi-asserted-by":"publisher","first-page":"40","DOI":"10.1109\/MSP.2007.48","volume":"2","author":"R Lyda","year":"2007","unstructured":"Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. IEEE Secur. Privacy 2, 40\u201345 (2007)","journal-title":"IEEE Secur. Privacy"},{"key":"23_CR24","unstructured":"Olivain, J., Goubault-Larrecq, J.: Detecting subverted cryptographic protocols by entropy checking. Laboratoire Specification et Verification, ENS Cachan, France, Research Report LSV-06-13 (2006)"},{"key":"23_CR25","doi-asserted-by":"crossref","unstructured":"Wagner, A., Plattner, B.: Entropy based worm and anomaly detection in fast IP networks. In: WETICE 2005 Proceedings of the 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise, pp. 172\u2013177. IEEE Computer Society, Washington, DC (2005)","DOI":"10.1109\/WETICE.2005.35"},{"key":"23_CR26","unstructured":"Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers, San Francisco (1993). ISBN=1-55860-238-0"},{"issue":"1","key":"23_CR27","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1145\/1656274.1656278","volume":"11","author":"M Hall","year":"2009","unstructured":"Hall, M., et al.: The WEKA data mining software: an update. ACM SIGKDD Explorations Newsletter 11(1), 10\u201318 (2009)","journal-title":"ACM SIGKDD Explorations Newsletter"},{"key":"23_CR28","unstructured":"RStudio, an integrated development environment (IDE)for R. http:\/\/www.rstudio.com"},{"key":"23_CR29","doi-asserted-by":"crossref","unstructured":"Sicker, D.C., Ohm, P., Grunwald, D.: Legal issues surrounding monitoring during network research, In: Proceeding 7th ACM SIGCOMM conference on Internet measurement, ser. IMC 2007, pp. 141\u2013148. ACM, New York (2007)","DOI":"10.1145\/1298306.1298307"},{"key":"23_CR30","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"65","DOI":"10.1007\/978-3-642-04968-2_6","volume-title":"IP Operations and Management","author":"JY Chung","year":"2009","unstructured":"Chung, J.Y., Park, B., Won, Y.J., Strassner, J., Hong, J.W.: Traffic classification based on flow similarity. In: Nunzi, G., Scoglio, C., Li, X. (eds.) IPOM 2009. LNCS, vol. 5843, pp. 65\u201377. Springer, Heidelberg (2009)"},{"key":"23_CR31","doi-asserted-by":"crossref","unstructured":"Keralapura, R., Nucci, A., Chuah, C.-N.: Self-learning peer-to-peer traffic classifier. In: Proceedings of 18th Internatonal Conference on Computer Communications and Networks, ICCCN. IEEE (2009)","DOI":"10.1109\/ICCCN.2009.5235313"},{"key":"23_CR32","unstructured":"TCPDUMP packet analizer. http:\/\/www.tcpdump.org"},{"key":"23_CR33","unstructured":"Croll, G.J.: BiEntropy-The Approximate Entropy of a Finite Binary String (2013). arXiv preprint arXiv:1305.0954"},{"issue":"5","key":"23_CR34","doi-asserted-by":"publisher","first-page":"5197","DOI":"10.1016\/j.eswa.2010.10.041","volume":"38","author":"M Zhao","year":"2011","unstructured":"Zhao, M., et al.: Feature selection and parameter optimization for support vector machines: a new approach based on genetic algorithm with feature chromosomes. Expert Syst. Appl. 38(5), 5197\u20135204 (2011)","journal-title":"Expert Syst. Appl."},{"key":"23_CR35","unstructured":"LS-SVMlab toolbox. http:\/\/www.esat.kuleuven.ac.be\/sista\/lssvmlab"},{"key":"23_CR36","doi-asserted-by":"crossref","unstructured":"Erman, J., Arlitt, M., Mahanti, A.: Traffic classification using clustering algorithms. In: Proceedings of the SIGCOMM workshop on Mining network data. ACM (2006)","DOI":"10.1145\/1162678.1162679"},{"key":"23_CR37","volume-title":"Algorithms for Clustering Data","author":"AK Jain","year":"1988","unstructured":"Jain, A.K., Dubes, R.C.: Algorithms for Clustering Data. Prentice Hall, Englewood Cliffs (1988)"}],"container-title":["Lecture Notes in Computer Science","Information and Communications Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-29814-6_23","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,1]],"date-time":"2025-06-01T17:20:40Z","timestamp":1748798440000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-29814-6_23"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"ISBN":["9783319298139","9783319298146"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-29814-6_23","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]},"assertion":[{"value":"5 March 2016","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}