Issues and future directions in traffic classification

Abstract

he variety and complexity of modern Internet traffic exceeds anything imagined by the original designers of the underlying Internet architecture. As the Internet becomes our most critical communications infrastructure, service providers attempt to retrofit functionality, including security, reliability, privacy, and multiple service qualities, into a "best effort" architecture originally intended to support a research environment. In order to prioritize, protect, or prevent certain traffic, providers need to implement technology for traffic classification: associating traffic flows with the applications -or application types -that generated them. When the focus is on detecting specific applications (e.g., Skype), the term traffic identification is sometimes used. Despite the increasing dependence on the Internet, there is essentially no scientifically reproducible body of research on global Internet traffic characteristics due to the sensitivity of and typical restrictions on sharing traffic data. Despite these constraints, security concerns and economic realities have motivated recent advances in traffic classification capabilities. Situational awareness of traffic is essential to prevention, mitigation, and response to new forms of malware, which can suddenly and rapidly threaten legitimate service on network links. Arguably as important, the high cost of deploying and operating Internet infrastructure compels providers to continually seek ways to optimize their network engineering or otherwise increase return on capital investments, including applicationbased service differentiation and content-sensitive pricing.For these reasons, the state of the art in traffic classification has experienced a major boost in the past few years, measured in the number of publications and research groups focused on the topic. Diverse interests have led to a heterogeneous, fragmented, and somewhat inconsistent landscape. A recent survey of traffic classification literature reviewed advantages and problems with different approaches, but acknowledged their general lack of accuracy and applicability [1], whereas others took a narrower focus, taxonomizing and reviewing documented machine-learning approaches for IP traffic classification [2].In this article we provide a critical but constructive analysis of the field of Internet traffic classification, focusing on major obstacles to progress and suggestions for overcoming them. We first give an overview of both the evolution of traffic classification techniques and constraints to their development. After briefly summarizing results of surveys in this field, we highlight key differences across existing approaches and techniques. We then discuss the main obstacles to progress in the current state of the art, including required trade-offs in applicability, reliability, performance, and respect for privacy. The persistently unsolved challenges in the field over the last decade suggest the need for different strategies and actions, which we recommend in the concluding section. Traffic Cl...

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

“…Internet traffic classification techniques such as port number matching, payload signature matching, statistics, and application behavior-based methods have been the foundation for traffic classification engines for many years [1], [3], [8], [9]. However, these methods are not yet applicable to real Copyright c 2014 The Institute of Electronics, Information and Communication Engineers networks.…”

“…In previous studies, categorization was not associated with an application name but rather an L7 protocol name [1]- [3]. However, criteria for application naming are needed because many applications can use an L7 protocol such as hypertext transfer protocol (HTTP) for various purposes.…”

Protocol misidentification made easy with format-transforming encryption

“…Alternative protocol identification strategies that have been explored include using packet sizes and timings [6,51], the types and number connections initiated by a host (its "social behavior") [23,26], and various machine learning techniques [33,34,55]. However, the feasibility of deploying more sophisticated classification strategies for DPI at scale remains unclear [11,34,40].…”

An Effective New Approach for Network Traffic Classification

“…network management system to network system security [1], from benefit separation to network traffic engineering, from slant investigation to network traffic research [3].…”