MIPT and IPPI RAS: hybrid Random Forest Traffic Classifier (hRFTC)

Main Article: Data Quality Management

2025: hRFTC Algorithm Presentation

Proposed by a joint scientific group from MIPT IPPI RAN algorithm and under the name hybrid Random Forest Traffic Classifier (hRFTC) allows you to effectively determine the type of transmitted, data even if they are encrypted use the latest technologies. To analyze its effectiveness database , encrypted traffic from six countries was collected, and. North America Europe Asia The proven quality of classification is 94.6%. MIPT announced this on January 21, 2025.

As the volume of encrypted Internet traffic increases, the task of determining the type of data transmitted becomes more and more difficult. The Transport Layer Security (TLS) protocol provides data protection, but the new version of the protocol - Encrypted ClientHello (ECH) - hides key metadata such as Server Name Indication (SNI), which complicates the process of early traffic classification (eTC). This can adversely affect the quality of service in networks, since proper traffic classification is necessary for effective resource management.

This algorithm uses not only open TLS ECH parameters, but also traffic statistics such as packet sizes and inter-arrival intervals. This approach significantly increased the accuracy of data recognition from 38.4% to 96.4% according to the F-score metric.  

According to one of the authors of the project, Anton Kurapov, a student of the basic department of MIPT at the IPPI RAS, the developed algorithm can be used at intermediate network nodes to improve the quality of service.

𝓲

Фото: MIPT

Our hRFTC algorithm has surpassed the best existing classifiers and can be used on intermediate network nodes to improve the quality of service. On the other hand, we have identified the remaining leaks in the privacy of encrypted traffic that need to be eliminated in future versions of transport-level protection protocols , "continued Anton Kurapov.

As of January 2025, the wireless network laboratory team is researching to eliminate these privacy leaks by randomizing open parameters, as well as changing the lengths of the first stream packets and sending additional fictitious packets.