Identifying VoIP traffic in VPN tunnel via Flow Spatio-Temporal Features

The persistent emergence of new network applications, along with encrypted network communication, has make traffic analysis become a challenging issue in network management and cyberspace security. Currently, virtual private network (VPNs) has become one of the most popular encrypted communication services for bypassing censorship and guarantee remote access to geographically locked services. In this paper, a novel identification scheme of VoIP traffic tunneled through VPN is proposed. We employed a set of Flow Spatio-Temporal Features (FSTF) to six well-known classifiers, including decision trees, K-Nearest Neighbor (KNN), Bagging and Boosting via C4.5, and Multi-Layer perceptron (MLP). The overall accuracy, precision, sensitivity, and F-measure verify that the proposed scheme can effectively distinguish between the VoIP flows and Non-VoIP ones in VPN traffic.