Automatic Payload Signature Generation for Accurate Identification of Internet Applications and Application Services

Abstract

The diversity and fast growth of Internet traffic volume are highly influenced by mobile and computer applications being developed. Moreover, the developed applications are too dynamic to be identified and monitored by network administrators. Several approaches have been proposed to identify network applications, however, are still not robust enough to identify modern applications. This paper proposes both, TSA (Traffic collection, Signature generation and Applications identification) system and a derived algorithm so called CSP (Contiguous Sequential Patterns) to identify applications for management and security in IP networks. The major focus of this paper is the CSP algorithm which is automated in two modules (Signature generation and Applications identification) of the proposed system. The proposed CSP algorithm generates DNA-like unique signatures capable of identifying applications and their individual services. In this paper, we show that the algorithm is suitable for generating efficient signatures to identify applications and application services in high accuracy.

Two-Pathway Model for Enhancement of Protocol Reverse Engineering

“…For a prompt extraction with low overhead, we modify a sequential pattern mining algorithm that finds common characters or hex values in the traffic payload. We refer to this modified algorithm as the contiguous sequential pattern (CSP) algorithm [29]. This algorithm can find protocol patterns very quickly with low memory requirements, because it eliminates candidate patterns at an early stage if they do not satisfy a minimum support threshold.…”