Application traffic classification using payload size sequence signature

Shim, Kyuseok; Ham, Jae-Hyun; Sija, Baraka D.; Kim, Myung-Sup

doi:10.1002/nem.1981

Cited by 23 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…and packet-based (e.g., packet length, standard deviation of packet size, packet directions, packet intervals etc.) attributes with the classification task [10]. These hand-designed attributes are further deployed to machine learning (ML) algorithms to classify the specific network traffic flow and characterize them according to the need of the network administrators.…”

Section: Statistical Classificationmentioning

confidence: 99%

VoIP Traffic Detection in Tunneled and Anonymous Networks Using Deep Learning

et al. 2021

View full text Add to dashboard Cite

Network management is facing a great challenge to analyze and identify encrypted network traffic with specific applications and protocols. A significant number of network users applying different encryption techniques to network applications and services to hide the true nature of the network communication. These challenges attract the network community to improve network security and enhance network service quality. Network managers need novel techniques to cope with the failure and shortcomings of the port-based and payload-based classification methods of encrypted network traffic due to emergent security technologies. Mainly, the famous network hopping mechanisms used to make network traffic unknown and anonymous are VPN (virtual private network) and TOR (Onion Router). This paper presents a novel scheme to unveil encrypted network traffic and easily identify the tunneled and anonymous network traffic. The proposed identification scheme uses the highly desirable deep learning techniques to easily and efficiently identify the anonymous network traffic and extract the Voice over IP (VoIP) and Non VoIP ones within encrypted traffic flows. Finally, the captured traffic has been classified into four different categories, i-e., VPN VoIP, VPN Non-VoIP, TOR VoIP, and TOR Non-VoIP. The experimental results show that our identification engine is extremely robust to VPN and TOR network traffic.

show abstract

Section: Statistical Classificationmentioning

confidence: 99%

VoIP Traffic Detection in Tunneled and Anonymous Networks Using Deep Learning

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Offline classification is not helpful for online management and control, mainly due to the performance [14]. Online network traffic classification is very important for several reasons:…”

Section: Online Classificationmentioning

confidence: 99%

“…Shim KS et al in [14] Proposed traffic classification method using payload size sequence signature (PSS). The proposed classifier generates unique sequence PSS for each internet application from the first N packets of the flow.…”

Section: Related Work 21 Related Internet Traffic Classification Systemsmentioning

confidence: 99%

A Hybrid Online Classifier System for Internet Traffic Based on Statistical Machine Learning Approach and Flow Port Number

et al. 2021

View full text Add to dashboard Cite

Internet traffic classification is a beneficial technique in the direction of intrusion detection and network monitoring. After several years of searching, there are still many open problems in Internet traffic classification. The hybrid classifier combines more than one classification method to identify Internet traffic. Using only one method to classify Internet traffic poses many risks. In addition, an online classifier is very important in order to manage threats on traffic such as denial of service, flooding attack and other similar threats. Therefore, this paper provides some information to differentiate between real and live internet traffic. In addition, this paper proposes a hybrid online classifier (HOC) system. HOC is based on two common classification methods, port-base and ML-base. HOC is able to perform an online classification since it can identify live Internet traffic at the same time as it is generated. HOC was used to classify three common Internet application classes, namely web, WhatsApp and Twitter. HOC produces more than 90% accuracy, which is higher than any individual classifiers.

show abstract

“…Upgrades in internet connection speeds, with the emergence of 4G LTE cellular and fiber optic communications, has led to a multiplication of services offered by modern telecommunication networks and to unprecedented growth in the number of users and traffic volumes that they generate . Internet traffic is forecasted to increase nearly threefold over the next 5 years.…”

Section: Introductionmentioning

confidence: 99%

New fluid approaches for studying the performance of elastic traffic under class based weighed fair queuing system

2018

View full text Add to dashboard Cite

Although TCP is typically designed to carry data (transfer of documents such as files or web pages), it is also suitable, today, for transporting most commercial video-streaming traffic such as YouTube or Netflix traffic. The class-based weighted fair queuing is still an important router discipline that allows different classes of elastic flows (generally, TCP flows) to be transported together in a truly converged network. Such system has been extensively studied in packet level by evaluating several criteria of effectiveness such as the mean queue length and the average queue waiting time, without proposing a general model that captures the flow-level dynamics and the real coupling aspect between different queues.Moreover, most studies limited their works to a simple two-queue system where performance evaluation is very much easier. Even the few works focusing on providing extended results did not give accurate results for very loaded systems.Proposed packet-level models seem, then, to be not convenient to predict the performance of large-scale operator networks with millions of users, millions of flows, and unexpected user behaviors. This paper aims to overcome these limitations by presenting new analytical explicit mathematical expressions evaluating the flow-level performance metrics of elastic traffic under a general class-based weighted fair queuing system. The core of our analysis is based on some approximations proven for balanced fairness allocation, which provides a reasonable framework for estimating bandwidth sharing among elastic traffic for best-effort allocations. Detailed packet level simulations are used to verify the accuracy and the effectiveness of the proposed approaches.

show abstract

Application traffic classification using payload size sequence signature

Cited by 23 publications

References 16 publications

VoIP Traffic Detection in Tunneled and Anonymous Networks Using Deep Learning

VoIP Traffic Detection in Tunneled and Anonymous Networks Using Deep Learning

A Hybrid Online Classifier System for Internet Traffic Based on Statistical Machine Learning Approach and Flow Port Number

New fluid approaches for studying the performance of elastic traffic under class based weighed fair queuing system

Contact Info

Product

Resources

About