This work explores the use of a Multi-Objective Genetic Algorithm (MOGA) for both, feature selection and cluster count optimization, for an unsupervised machine learning technique, K-Means, applied to encrypted traffic identification (SSH). The performance of the proposed model is benchmarked against other unsupervised learning techniques existing in the literature: Basic K-Means, semi-supervised K-Means, DBSCAN, and EM. Results show that the proposed MOGA, not only outperforms the other models, but also provides a good trade off in terms of detection rate, false positive rate, and time to build and run the model. A hierarchical version of the proposed model is also implemented, to observe the gains, if any, obtained by increasing cluster purity by means of a second layer of clusters. Results show that with the hierarchical MOGA, significant gains are observed in terms of the classification performances of the system.

The adoption of 5G mobile networks is changing the way we connect our world. Now, it is not just phones that are connected to the network, it is everything - smart homes, self-driving cars, factory equipment, and anything in between. Because of this, there has been a large increase in the volume and complexity of mobile network traffic in recent years. As 5G becomes more widely adopted, this trend will continue moving forward. This presents a problem for mobile network operators. To account for this increase in traffic volume and complexity, the network must be optimized to handle it. However, the only way to do this is to better understand the traffic sent over the network. As such, the companies building and operating these networks rely on models that can define a set of traffic profiles from real-world network data. This thesis presents a novel method of identifying traffic profiles from 5G network data by analyzing the network traffic as unstructured time series data. Using two datasets containing TCP and UDP traffic data with 10 million time series apiece, clusters were defined for each using time series clustering techniques. Specifically, the ROCKET family of algorithms was adapted for clustering purposes, applying k-means clustering on top of the ROCKET feature transformations. The resulting clusters were analyzed and compared to another clustering model - one based on summary statistics from each time series. Overall, the ROCKET models appeared to produce more coherent traffic profiles compared to the baseline clustering model, and the proposed framework shows great promise - not just in network traffic clustering, but any analysis of unstructured time series data.