Network traffic signature generation mechanism using principal component analysis

Abstract

The Deep Packet Inspection (DPI) method is a popular method that can accurately identify the flow data and its corresponding application. Currently, the DPI method is widely used in common network management systems. However, the major limitation of DPI systems is that their signature library is mainly extracted manually, which makes it hard to efficiently obtain the signature of new applications. Hence, in this paper, we propose an automatic signature extraction mechanism using Principal Component Analysis (PCA) technology, which is able to extract the signature automatically. In the proposed method, the signatures are expressed in the form of serial consistent sequences constructed by principal components instead of normally separated substrings in the original data extracted from the traditional methods. Extensive experiments based on numerous sets of data have been carried out to evaluate the performance of the proposed scheme, and the results prove that the newly proposed method can achieve good performance in terms of accuracy and efficiency.

Automatic Payload Signature Generation for Accurate Identification of Internet Applications and Application Services

“…Besides, Table 4 in general, summarizes the superiority of the proposed method, as an approach capable of identifying both, an application and its individual services. [18] 2012 ✓ (Unnamed) X ✓ X M. Cheng et al [20] 2013 ✓ (Unnamed) X ✓ X FlowAntEater [21] 2013 ✓ (FlowAntEater) ✓ (SSMA) ✓ X S. Yoon et al [24] 2014 ✓ (Unnamed) X ✓ X H. Min An et al [27] 2015 ✓ (Unnamed) X ✓ X SigBox [28] 2017…”

“…DSA Biometric Signatures for Internet-based applications Polygraph [13] 2005 BGA Signatures for Polymorphic worms LASER [14] 2008 LCS Internet application identification AutoSig [15] 2009 ASMA Applications signatures generation R. Perdisci et al [16] 2010 BCA HTTP malware signatures generation Zhanyi Wang [17] 2012 ANN & DL Network traffic identification Y. Wang et al [18] 2012 SAA Automatic signature generation FIRMA [19] 2013 LCS Generation of network signatures for malware M. Cheng et al [20] 2013 PCA Automatic signature extraction FlowAntEater [21] 2013 K-means & SSMA Generation and evaluation of applications signatures J. Tharp et al [22] 2013 Heuristics Reconciliation of multiple matching Hwan-Hee Kim & Min-Jung Choi [23] 2013…”

“…This approach involves four procedures, pre-processing to extract application session payload, tokenization to find common substrings and incorporate position constraints, multiple sequence alignment to find common subsequences, and signature construction to transform the results into regular expression. M. Cheng et al [20], proposes an automatic signature extraction mechanism using Principal Component Analysis (PCA) technology to automatically extract signatures. The signatures extracted by this method are expressed in the form of serial consistent sequences constructed by principal components.…”

Research on Integrated Scale Prediction of Freeway and Expressway in Metropolitan Area

“…The basic capacity refers to the maximum traffic permitted of one lane's section in a certain period of time (taking 15min or 1 h) under ideal road and traffic control conditions [7]. The calculation formula by the headway time is defined as follow.…”