Analyzing Encrypted Facebook Traffic

Accurate network traffic identification would assist network operations and management teamseffectively on many different network tasks such as managing bandwidth and ensuring security. Thedemand for bandwidth management methods that optimize network performance and provide quality ofservice (QoS) guarantees has increased substantially in recent years. As new social networking andpeer-to-peer (P2P) applications such as Facebook and Skype have dramatically grown in popularityover the past few years, they now constitute a significant share of the total traffic in many networks.Therefore, identification of such network traffic plays an important role in many areas such as trafficengineering, QoS, security and so on. In this research, we aim to investigate how encrypted Facebook trafficcan be accurately and rapidly identified from observing the statistical properties of a small sequence of packetattributes. Indeed, covering a collection of different encrypted behaviors makes it difficult to distinguishFacebook from non-Facebook traffic. Moreover, being in encrypted tunnels, it is challenging to predict whatkind of a Facebook communication (e.g. voice, chat or video) is used in the encrypted Facebook traffic withoutdecrypting the traffic. Thus, the goal of this research is to develop a model that not only distinguishes Facebooktraffic from non-Facebook traffic on the network, but also is able to separate Facebook traffic into chat, voiceand video components without decrypting it.