The question
How can machine learning help classify Internet traffic when encryption limits what we can inspect? I reviewed the learning methods, traffic features, datasets and security use cases explored in earlier research.
The review covers application and protocol classification, anomaly detection and malicious traffic identification.
What I learned
- Packet sizes, directions, timing and statistical flow features can remain useful when payloads are encrypted.
- No learning method is universally best. Performance depends on the task, data and features.
- A high benchmark score does not establish reliability in changing networks. Generalisation, robustness, processing speed and maintainability matter.
Scope
This is a literature review of published research. It does not present an original experimental benchmark or a deployed classifier.
- Original title
- Koneoppimiseen perustuva Internet-liikenteen luokittelu tietoturvan näkökulmasta
- Author
- Abdirahman Jibril
- Institution
- Aalto University, School of Electrical Engineering
- Manuscript date
- 15 July 2026
- Language
- Finnish, with an English abstract