Lightweight, Payload-Based Traffic Classification: An Experimental Evaluation

Risso, Fulvio; Baldi, Mario; Morandi, O.; Baldini, Andrea; Monclus, Pilas Allende

doi:10.1109/icc.2008.1097

Cited by 62 publications

(40 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Internet traffic classification techniques such as port number matching, payload signature matching, statistics, and application behavior-based methods have been the foundation for traffic classification engines for many years [1], [3], [8], [9]. However, these methods are not yet applicable to real Copyright c 2014 The Institute of Electronics, Information and Communication Engineers networks.…”

Section: Related Workmentioning

confidence: 99%

“…The SBM thus requires more packets than does the PBM. Moreover, the SBM requires additional overhead for recombining packets that incur packet loss and undergo asymmetrical routing [1]. Therefore, we use PBM rather than SBM in the baseline system.…”

Section: Baseline Classification Systemmentioning

confidence: 99%

“…In previous studies, categorization was not associated with an application name but rather an L7 protocol name [1]- [3]. However, criteria for application naming are needed because many applications can use an L7 protocol such as hypertext transfer protocol (HTTP) for various purposes.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYInternet traffic classification is an essential step for stable service provision. The payload signature classifier is considered a reliable method for Internet traffic classification but is prohibitively computationally expensive for real-time handling of large amounts of traffic on high-speed networks. In this paper, we describe several design techniques to minimize the search space of traffic classification and improve the processing speed of the payload signature classifier. Our suggestions are (1) selective matching algorithms based on signature type, (2) signature reorganization using hierarchical structure and traffic locality, and (3) early packet sampling in flow. Each can be applied individually, or in any combination in sequence. The feasibility of our selections is proved via experimental evaluation on traffic traces of our campus and a commercial ISP. We observe 2 to 5 times improvement in processing speed against the untuned classification system and Snort Engine, while maintaining the same level of accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Baseline Classification Systemmentioning

confidence: 99%

See 1 more Smart Citation

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…기존의 제안된 포트 기반 분류 방법 [6,7] , 페이로드 시그니쳐 분류 방법 [8,9,10] , 머신러닝 분 류 방법 [11,12] 법론을 제안한다. 본 논문에서 구축한 멀티레벨 트래 픽 분석 시스템은 헤더 시그니쳐 [13] , 통계 시그니쳐 [14] , 페이로드 시그니쳐 [9] , 행동양식 기반 알고리즘 [15] 의 따라서, IANA [6] 에 정의된 포트 정보 기반의 분류 방법을 통해 신뢰성과 정확성이 높은 트래픽 분류 결과를 도출할 수 있었다.…”

unclassified

“…페이로드 시그니쳐 기반 트래픽 분류 방법론 [8][9][10] 은 패킷의 페이로드 내에서 응용마다 가지는 특정한 [13] , 응용 트래픽의 발생 형태를 사용하여 트래픽을 분석 하는 행동 기반 방법론 [15] , 트래픽 상이의 연관성을 사용한 상관 관계 기반 방법론 [17,18] 등 다양한 분석 방법론이 제안되고 있다. …”

unclassified

Performance Improvement of a Real-time Traffic Identification System on a Multi-core CPU Environment

Yoon¹,

Park²,

Kim³

2012

The Journal of Korea Information and Communications Society

View full text Add to dashboard Cite

The application traffic analysis is getting more and more challenging due to the huge amount of traffic from high-speed network link and variety of applications running on wired and wireless Internet devices. Multi-level combination of various analysis methods is desired to achieve high completeness and accuracy of analysis results for a real-time analysis system, while requires much of processing burden on the contrary. This paper proposes a novel architecture for a real-time traffic analysis system which improves the processing performance on multi-core CPU environment. The main contribution of the proposed architecture is an efficient parallel processing mechanism with multiple threads of various analysis methods. The feasibility of the proposed architecture was proved by implementing and deploying it on our campus network.

show abstract

Header signature maintenance for Internet traffic identification

Yoon

Park

Sija

et al. 2016

Int. J. Network Mgmt

View full text Add to dashboard Cite

Summary Various traffic identification methods have been proposed with the focus on application‐level traffic analysis. Header signature–based identification using the 3‐tuple (Internet Protocol address, port number, and L4 protocol) within a packet header has garnered a lot of attention because it overcomes the limitations faced by the payload‐based method, such as encryption, privacy concerns, and computational overhead. However, header signature–based identification does have a significant flaw in that the volume of header signatures increases rapidly over time as a number of applications emerge, evolve, and vanish. In this article, we propose an efficient method for header signature maintenance. Our approach automatically constructs header signatures for traffic identification and only retains the most significant signatures in the signature repository to save memory space and to improve matching speed. For the signature maintenance, we define a new metric, the so‐called signature weight, that reflects its potential ability to identify traffic. Signature weight is periodically calculated and updated to adapt to the changes of network environment. We prove the feasibility of the proposed method by developing a prototype system and deploying it in a real operational network. Finally, we prove the superiority of our signature maintenance method through comparison analysis against other existing methods on the basis of various evaluation metrics.

show abstract

Lightweight, Payload-Based Traffic Classification: An Experimental Evaluation

Cited by 62 publications

References 12 publications

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Performance Improvement of a Real-time Traffic Identification System on a Multi-core CPU Environment

Header signature maintenance for Internet traffic identification

Contact Info

Product

Resources

About