Abstract: With the diversification of network application service types and the continuous development of traffic encryption technology, encrypted traffic identification has become a major challenge in the field of network security. Traditional traffic identification techniques, such as deep packet inspection, cannot effectively identify encrypted traffic, while the identification technology based on machine learning theory has shown good results. For this, an optimized encrypted traffic classification model based on the fusion of GBDT and LR is proposed, in which Bayesian optimization (BO) algorithm is used for hyperparameter tuning. By using the time-related flow features to identify common encrypted traffic and VPN encrypted traffic, it obtains an overall accuracy more than 90%, which gets better recognition effect than other common classification models.

Key words: encrypted traffic identification, GBDT (Gradient Boosting Decision Tree), LR (Logistic Regression), flow features, Bayesian optimization