標題: Application classification using packet size distribution and port association
作者: Lin, Ying-Dar
Lu, Chun-Nan
Lai, Yuan-Cheng
Peng, Wei-Hao
Lin, Po-Ching
資訊工程學系
Department of Computer Science
關鍵字: Traffic classification;Transport layer behaviors;Packet size distribution;Ports association
公開日期: 1-Sep-2009
摘要: Traffic classification is an essential part in common network management applications such as intrusion detection and network monitoring. Identifying traffic by looking at port numbers is only suitable to well-known applications, while signature-based classification is not applicable to encrypted messages. Our preliminary observation shows that each application has distinct packet size distribution (PSD) of the connections. Therefore, it is feasible to classify traffic by analyzing the variances of packet sizes of the connections without analyzing packet payload. Ill this work, each connection is first transformed into a point in a multi-dimensional space according to its PSD. Then it is compared with the representative points of pre-defined applications and recognized as the application having a minimum distance. Once a connection is identified as a specific application, Port association is used to accelerate the classification by combining it with the other connections of the same session because applications usually use consecutive ports during a session. Using the proposed techniques, packet size distribution and port association, a high accuracy rate, 96% oil average, and low false positive and false negative rates, 4-5%, are achieved. Our proposed method not only works well for encrypted traffic but also can be easily incorporated with a signature-based method to provide better accuracy. (C) 2009 Elsevier Ltd. All rights reserved.
URI: http://dx.doi.org/10.1016/j.jnca.2009.03.001
http://hdl.handle.net/11536/6726
ISSN: 1084-8045
DOI: 10.1016/j.jnca.2009.03.001
期刊: JOURNAL OF NETWORK AND COMPUTER APPLICATIONS
Volume: 32
Issue: 5
起始頁: 1023
結束頁: 1030
Appears in Collections:Articles


Files in This Item:

  1. 000268516100008.pdf

If it is a zip file, please download the file and unzip it, then open index.html in a browser to view the full text content.