Machine Learning-Based Classification of Encrypted VPN and Non-VPN Traffic with Temporal Features Analysis

As Virtual Private Network (VPN) usage increases globally for privacy preservation and unrestricted access, distinguishing VPN traffic from regular internet traffic has become both critically important and challenging. Traditional detection methods relying on port-based rules and deep packet inspection are no longer reliable against encrypted communications, prompting the need for smarter, adaptive, machine learning (ML) solutions. This study proposes a comprehensive ML-based framework to classify VPN and non-VPN traffic using a large-scale, balanced dataset of approximately six million packets, covering common application types (Mail, Video Conferencing, SSH, Non-Streaming) and five VPN protocols (L2TP, OpenVPN, PPTP, SSTP, and WireGuard). Five models were evaluated: Logistic Regression, Decision Tree, K-Nearest Neighbors (KNN), Random Forest, and Artificial Neural Networks (ANN). When temporal (i.e., timestamp) features were included, KNN, Random Forest, and ANN achieved perfect classification accuracy of 100%, while Logistic Regression and Decision Tree reached 99%. Upon removal of timestamp features to simulate temporal generalizability, accuracy declined substantially across all models: Logistic Regression dropped to 67%, ANN to 86%, KNN to 90%, and both Decision Tree and Random Forest achieved 92%. False positive rates without timestamps ranged from 0.009% (Logistic Regression) to 31.1% (Decision Tree), and false negative rates ranged from 0% to 39.1%. Critically, source and destination port numbers emerged as the most discriminative features for accurate classification, with VPN traffic concentrated on just 11 of over 1,700 observed ports. These findings demonstrate the significant role of temporal features in VPN traffic classification, quantify the performance degradation caused by their removal (timestamp bias), and establish that ML-based approaches—particularly ensemble methods—can effectively address the challenges of encrypted traffic analysis even in temporally limited training scenarios.