Method for classifying the payload of encrypted traffic flows

A computing device executing a plurality of virtual machines for implementing network function virtualization (NFV), wherein a virtual machine from the plurality of virtual machines is configured to execute a method to classify encrypted data traffic, the method to identify characteristics of the encrypted data traffic that have been modeled where network anomalies have been injected into the encrypted data traffic to provide additional traffic characteristics that enable categorization, the computing device comprising:

• a non-transitory computer-readable storage medium having stored therein an encrypted traffic categorizer;
• and
• a processor coupled to the non-transitory computer-readable storage medium, the processor configured to execute one of the plurality of virtual machine, the virtual machine to execute the encrypted traffic categorizer, the encrypted traffic categorizer to receive the encrypted data traffic, to apply an encrypted traffic categorization model to the received encrypted data traffic to determine a first categorization identification, to inject an anomaly into the encrypted data traffic where the first categorization identification is not within a precision threshold, to apply the encrypted traffic categorization model to monitored encrypted traffic after injection of the anomaly to determine a second categorization identification, and to apply the second categorization identification where the second categorization identification is within the precision threshold.

A control plane device configured to implement at least one centralized control plane for a software defined network (SDN), the centralized control plane configured to execute method to classify encrypted data traffic, the method to identify characteristics of the encrypted data traffic that have been modeled where network anomalies have been injected into the encrypted data traffic to provide additional traffic characteristics that enable categorization, the control plane device comprising:

• a non-transitory computer-readable storage medium having stored therein an encrypted traffic categorizer;
• and
• a processor coupled to the non-transitory computer-readable storage medium, the processor configured to execute the encrypted traffic categorizer, the encrypted traffic categorizer to receive the encrypted data traffic, to apply an encrypted traffic categorization model to the received encrypted data traffic to determine a first categorization identification, to inject an anomaly into the encrypted data traffic where the first categorization identification is not within a precision threshold, to apply the encrypted traffic categorization model to monitored encrypted traffic after injection of the anomaly to determine a second categorization identification, and to apply the second categorization identification where the second categorization identification is within the precision threshold.