Efficient Keyword Matching for Deep Packet Inspection based Network Traffic Classification

Khandait, Pratibha; Hubballi, Neminath; Mazumdar, Bodhisatwa

doi:10.1109/comsnets48256.2020.9027353

Cited by 18 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In these tables, column headers include the name of device and number within bracket indicates the number of flows used in testing. For example, in Table 4, the second column Belkin Motion Sensor (26,197) indicates there are 26,197 flows in testing dataset of this device. We can notice from Table 5 that in all the cases the number of flows classified correctly has increased along with a significant reduction in number of unclassified cases.…”

Section: Recallmentioning

confidence: 99%

“…This is achieved through 1. Reducing the quantum of payload data screened for finding the keywords: Our initial work [26] in this direction has proposed few optimizations. 2.…”

Section: Ta B L E 6 Confusion Matrix For Keyword-based Classification...mentioning

confidence: 99%

“… Reducing the quantum of payload data screened for finding the keywords: Our initial work [26] in this direction has proposed few optimizations. Incorporating heuristic‐based optimizations for reducing the overhead of string comparisons: Few works like Hyperscan [27] and DFC [28] implement such optimizations. Implementing DPI on hardware platforms: Customised hardware circuits using FPGA and other similar hardware platforms can be used to implement the DPI operations on it. Several commercial vendors like CISCO have similar products in the market. Machine learning‐based IoT traffic classifiers with payload features can be an interesting study particularly if there are multiple keywords and presence of one or more of them might be good enough to label the flow. …”

Section: Limitation and Possible Extensionsmentioning

confidence: 99%

See 2 more Smart Citations

IoTHunter: IoT network traffic classification using device specific keywords

2021

Self Cite

View full text Add to dashboard Cite

With the proliferation of IoT devices, network management and security monitoring are becoming a challenge. For the timely detection of IoT device status and their behaviour, traffic classification methods are used. Herein, IoTHunter, a Deep Packet Inspection based IoT traffic classifier, is described. It extracts unique keywords comprising domain names, device names etc. to identify flows belonging to a particular device. IoTHunter automates the keyword extraction using the frequency of occurrence of words belonging to flows of different devices. To further enhance the performance, IoTHunter combines device specific keywords with MAC address of device for subsequent flow labelling. A publicly available IoT dataset is experimented and a good classification accuracy of it over a range of IoT devices is demonstrated. This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

Section: Recallmentioning

confidence: 99%

“…This is achieved through 1. Reducing the quantum of payload data screened for finding the keywords: Our initial work [26] in this direction has proposed few optimizations. 2.…”

Section: Ta B L E 6 Confusion Matrix For Keyword-based Classification...mentioning

confidence: 99%

Section: Limitation and Possible Extensionsmentioning

confidence: 99%

See 1 more Smart Citation

IoTHunter: IoT network traffic classification using device specific keywords

2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…For evaluation, they utilized the JnetPcap library and Aho‐Corasic FSM on the first 100 bytes of each payload to derive keywords and the next 924 bytes to design application specific signatures. They were able to achieve a minimum recall of 93.72% 23 …”

Section: Related Workmentioning

confidence: 99%

Application layer classification of Internet traffic using ensemble learning models

2020

View full text Add to dashboard Cite

Summary Accurate application layer classification of Internet traffic has been a necessary requirement for various regulatory, control, and operational purposes of Internet service provider (ISP). Due to the dynamic and ever evolving nature of Internet applications generating a diverse mixture of Internet traffic, it has been necessary to apply deep packet inspection (DPI) techniques for traffic classification. DPI methods offer accuracy but degrade overall network throughput and thus cause problems in ensuring quality of service (QoS) and maintaining service‐level agreements. Moreover, Internet traffic is mostly end to end encrypted. This in turn limits the applicability of DPI techniques and renders them useless, unless the encryption tunnel is broken by the service provider which would risk violating user privacy. To address these trade‐offs between classification accuracy, performance, and user privacy, we resort to machine learning (ML)‐based algorithms. In this article, we apply three ensemble ML algorithms and report their performance metrics in the application layer classification of Internet traffic.

show abstract

“…Some approaches classify traffic according to its category i.e., whether the traffic represents file transfer, peer to peer (P2P), games, multimedia, web, or attacks [2]- [8]. Others try to identify the protocol involved at the application level such as file transfer protocol (FTP), hypertext transfer protocol (HTTP), secure shell (SSH), Telnet [9]- [14]. One particular study reviewed current traffic classification methods by classifying them into five categories: statistics-based, correlation-based, behaviour-based, payload-based, [15].…”

Section: Introductionmentioning

confidence: 99%

Features analysis of internet traffic classification using interpretable machine learning models

Adje

Houndji²,

Dossou³

2022

IJ-AI

View full text Add to dashboard Cite

Internet traffic classification is a fundamental task for network services and management. There are good machine learning models to identify the class of traffic. However, finding the most discriminating features to have efficient models remains essential. In this paper, we use interpretable machine learning algorithms such as decision tree, random forest and eXtreme gradient boosting (XGBoost) to find the most discriminating features for internet traffic classification. The dataset used contains 377,526 traffics. Each traffic is described by 248 features. From these features, we propose a 12-feature model with an accuracy of up to 99.76%. We tested it on another dataset with 19626 flows and obtained 98.40% of accuracy. This shows the efficiency and stability of our model. Also, we identify a set of 14 important features for internet traffic classification, including two that are crucial: port number (server) and minimum segment size (client to server).

show abstract

Efficient Keyword Matching for Deep Packet Inspection based Network Traffic Classification

Cited by 18 publications

References 12 publications

IoTHunter: IoT network traffic classification using device specific keywords

IoTHunter: IoT network traffic classification using device specific keywords

Application layer classification of Internet traffic using ensemble learning models

Features analysis of internet traffic classification using interpretable machine learning models

Contact Info

Product

Resources

About