Hardware Design for Statistical Network Traffic Classifiers

Abstract

Signature matching is commonly used in network traffic classification and can provide accurate and efficient results. However, it requires constant updates of signatures and can't be applied to encrypted traffic. Statistical behavior-based approaches can avoid the drawback of payload encryption. However, the computational complexity of related statistical features may prevent them being deployed in systems that are expected to respond in limited time. In this work, we combine the advantages of statistics-based classification approaches and hardware design techniques to develop a balanced classifier that can provide timely responses to. Two statistics-based solutions, a message size distribution classifier (MSDC) and a message size sequence classifier (MSSC) which depend on classification accuracy and real timeliness arc proposed. The former aims to identify network flows in an accurate but not-so-fast manner, while the latter aims to provide a lightweight and real-time solution. Simulations showed that MSSC contributed 77.4% and MSDC contributed 22.6% of decision rounds. Furthermore, our design can achieve an accuracy of more than 94% while achieving a throughput of 80 Gbps.