High-Speed Flow Nature Identification

Abstract

This paper concerns the fundamental problem of identifying the content nature of a flow, namely text, binary, or encrypted, for the first time. We propose Iustitia, a tool for identifying flow nature on the fly. The key observation behind Iustitia is that text flows have the lowest entropy and encrypted flows have the highest entropy, while the entropy of binary flows stands in between. The basic idea of Iustitia is to classify flows using machine learning techniques where a feature is the entropy of every certain number of consecutive bytes. The key features of Iustitia are high speed (10% of average packet inter-arrival time) and high accuracy (86%).

Using Entropy to Classify Traffic More Deeply

“…So Khakpour [20] does not carry out any experiments based on real-world packet traces. However, despite the difficulties mentioned above, we still utilize pure text and encrypted data, which are obtained from real-world traces for validation in our paper.…”

“…The work of Khakpour et al [20] was the pioneer of our task. They suggested a high-speed architecture which can separate flows into three categories, including text, binary and encrypted.…”

A Survey of Network Traffic Classification

“…В [6] потоки определяются как зашифрованные или незашифрованные на основании энтропии первого пакета. В [7] вычисление энтропии первых байтов полезной нагрузки идентифицирует тип содержимого как текст, бинарный файл или шифрованный файл, что позволяет приоритизировать передачу некоторых файлов. Однако, такую классификацию сложно назвать точной или детализированной, так как для одного и того же приложения возможно использование всех видов содержимого.…”

Network traffic classification method based on improved deep convolutional neural network

“…文 献 [17] 使用一个会话的第 1 个报文进行 DPI 检测, 实现及早的分类, 但是这种技术除了要预先提取 有效的签名外, 还要检测报文负载, 不仅导致计算开销大还会侵犯隐私. 为了解决 DPI 面临的一些问 题, Khakpour 等 [18] 使用随机报文探测 (stochastic packet inspection, SPI) 技术 [12] , 设计了一种快速 算法, 该算法计算报文中第 1 个负载字节数的信息熵进行载荷内容类型识别. 但是该技术仍然可能涉 及侵犯客户隐私的问题.…”