Srivathsan Thirumurugan

Identifying Network Traffic Signatures For Texting Via Instant Messaging Applications: A Machine Learning Approach (2024)

As Instant Messaging Applications become more popular, they can be used for a variety of purposes, including sending files, making voice and video calls as well as texting in groups and private channels for both personal and professional purposes.

I aim to explore network traffic signatures in instant messaging applications for network monitoring and analysis purposes. To achieve this I designed and developed a framework to automatically generate and capture traffic from the seven most used and popular instant messaging applications, namely Discord, Messenger, Signal, Skype, Teams, Telegram, and WhatsApp.

I have analyzed and discovered patterns of texting via IMAs from the perspective of texting behaviour such as synchronous and asynchronous communications. Moreover, their traffic is generated and captured with different types of user communication based on the number of participants such as private texting with two users, group texting with three users, and group texting with four users.

The resulting end-to-end encrypted traffic is analyzed using a machine-learning-based approach to traffic metadata without using deep packet inspection. Evaluations show that it is possible to identify between private, groups with different users for asynchronous and synchronous instant messaging applications.

This in return could help better planning and management of the network operations for user quality of service.

Identifying Synchronous and Asynchronous Communications in IMA Traffic (2025)

Instant messaging applications (IMAs) rely on message encryption to preserve privacy and security, which makes network traffic inspection difficult. For better network monitoring and analysis, we explore network traffic signatures in IMAs. We develop a framework to automatically generate and capture traffic from seven popular IMAs. We discover patterns from text messaging behavior, such as synchronous and asynchronous as well as group and private communications. We analyze the resulting end-to-end encrypted traffic using a machine learning-based approach to traffic metadata without using deep packet inspection. The evaluations show that it is possible to identify between groups with different numbers of users for asynchronous and synchronous communication models. This, in turn, can help better plan and manage network operations for better quality of service.

Encrypted Network Traffic Analysis (ENTA) Platform: IMA VoIP Traffic Identification (2025)

This paper introduces the Encrypted Network Traffic Analysis (ENTA) platform, a scalable AI-driven system de-signed for traffic analysis with support for identifying encrypted VoIP traffic generated by instant messaging applications (IMAs). User behaviors, such as exchanging audio messages through different IMAs, are emulated, and the resulting network traffic is captured for analysis. The ENTA platform's capabilities are demonstrated in feature extraction, data pre-processing, AI model training and testing, and generating key performance indi-cators (KPIs) to assist network operations teams. This demonstration showcases the ENTA system's end-to-end functionality with a particular emphasis on accurately classifying and identifying IMA VoIP traffic.