A TWO-STAGE FLOW-BASED METHOD FOR CLASSIFYING ENCRYPTED GOOGLE SERVICE TRAFFIC

Modern Internet traffic is dominated by a few global platforms, making accurate service identification essential for QoS management and network analytics. Yet pervasive encryption and shared infrastructure increasingly limit port-based methods and DPI. This paper presents a two-stage hierarchical framework for classifying encrypted Google-family traffic (YouTube, Gmail, Google Search) using only flow-level statistical and temporal features extracted with CICFlowMeter. Information Gain is applied to reduce feature redundancy and computational cost. As a baseline, a single-stage Random Forest achieved an overall accuracy of 0.89 but showed strong confusion between Gmail and Google Search. In the proposed framework, Stage 1 separates YouTube vs Other, and only flows predicted as Other are forwarded to Stage 2, where Gmail vs Search are distinguished. This staged design increased the overall accuracy from 0.89 to 0.96, with ROC-AUC of 0.99 for Stage 1 and 0.93 for Stage 2. The results indicate that hierarchical classification effectively mitigates service ambiguity in encrypted, shared-infrastructure environments and supports scalable telecom monitoring.