An automatic application signature construction system for unknown traffic

Abstract

SUMMARYIdentifying applications and classifying network traffic flows according to their source applications are critical for a broad range of network activities. Such a decision can be based on packet header fields, packet payload content, statistical characteristics of traffic and communication patterns of network hosts. However, most present techniques rely on some sort of a priori knowledge, which means they require labor-intensive preprocessing before running and cannot deal with previously unknown applications. In this paper, we propose a traffic classification system based on application signatures, with a novel approach to fully automate the process of deriving signatures from unidentified traffic. The key idea is to integrate statistics-based flow clustering with payload-based signature matching method, so as to eliminate the requirement of pre-labeled training data sets. We evaluate the efficiency of our approach using real-world traffic trace, and the results indicate that signature classifiers built from clustered data and pre-labeled data are able to achieve similar high accuracy better than 99%.

О Методах Идентификации Сетевых Трафиков

“…В работе [25] авторы предложили интегрировать кластеризацию, основанную на статистических характеристиках потока, с методом сравнения сигнатуры полезной информации, что исключает необходимость использования обучающих наборов данных. А в работе [26] авторы предложили комбинировать кластеризацию, основанную на статистических характеристиках потока, и кластеризацию, основанную на статистических характеристиках полезной информации для обнаружения неизвестного трафика.…”

Behaviour Based Worm Detection and Signature Automation

“…One of the biggest drawbacks for signature-based IDS is that they cannot detect zero-day worms (i.e., the worm's signature does not exist in the database). Meanwhile, some NIDS exist that check the content of network traffic; these include AutoGraph (Kim and Karp, 2004), EarlyBird (Sen et al, 2004), Anagram (Wang et al, 2010) and the LESG (Li et al, 2006) polymorphic worm (its signature can be changed each time it is sent to a vulnerable host).…”

Special issue: advanced topics on scalable computing

“…The key idea is to integrate statistics-based flow clustering with payload-based signature matching method, so as to eliminate the requirement of pre-labeled training data sets. The paper evaluates the efficiency of their approach using real-world traffic trace, and the results indicate that signature classifiers built from clustered data and pre-labeled data are able to achieve a similar high accuracy better than 99% [5].…”