Application classification using packet size distribution and port association

Cataloging Of Sessions in Genuine Traffic by Packet Size Distribution and Session Grouping

“…Nevertheless, previous job only focused on the peculiarities of network traffic classes or applications [7,8]. Henceforth, supplementary works [9][10][11][12][13] endeavored to organize completely network traffic based on statistical features. They generally consist of two parts: model building and Cataloging.…”

Fast Traffic Classification Using Joint Distribution of Packet Size and Estimated Protocol Processing Time

“…A method to classify applications by the time-series changes in the size of messages has been proposed in [11]. And Lin et al identified traffic types focusing on the consecutive port numbers in the session, based on the assumption that the application is more likely to use consecutive ports during a session [7]. This method can be added as an enhancement of our proposed method to achieve better classification speed.…”

“…However, the Euclidian Distance between the unknown flow packets and known application packets is a good metric to classify the traffic. Although the metric is a little rough, the classification results are fair [7].…”

“…For example, the applications get used to assign ports to communicate in a consecutive manner [7]. This character can be combined with the proposed method so that the quick classification techniques can be applied the TCP traffic with multiple connection in a session [7].…”

“…In this proposal, we use EPPT instead of IAT to investigate more precise protocol processing time features, and then reduce the location dependence and time dependence at the same time. In accordance with most of traditional literatures, unidirectional connections and flows in this paper are defined by the 5-tuple source IP, destination IP, protocol, source port and destination port [7]. The bidirectional flow is a pair of two unidirectional flows with inversed source and destination.…”