A Comparative Study of Random Forest and K-Nearest Neighbors with Hyperparameter Tuning for Encrypted Traffic Classification
摘要
A rise in encrypted network traffic raises challenges in providing appropriate security and management to the network since traditional content-based classification methods are not effective against modern encryption schemes such as SSL/TLS. Deep learning models have been proven to potentially address the challenges but result in huge computational costs, which renders them less feasible for real-time, resource-constrained environments. Our study here makes a focus on lightweight machine learning models, RF and KNN, to provide an efficient alternative for application-level encrypted traffic classification. The research involves a custom-built dataset, capturing traffic from YouTube, Dropbox, Telegram, and Skype, collected through controlled virtual machine environments. Raw pcap files were converted to CSV format, with a comprehensive feature engineering process transforming raw traffic data into meaningful representations suitable for machine learning analysis. Both RF and KNN models were evaluated under default and optimized hyperparameter configurations. Hyperparameter tuning further enhanced performance, with RF achieving 98.25% accuracy and outperforming KNN in all major metrics. The results confirm that light ML models, optimized in configuration, may achieve high classification accuracy while mitigating the computational disadvantage of DL methods. This puts RF and KNN into a position of becoming practical, resource-efficient solutions for encrypted traffic classification, particularly in real-time scenarios.