Payload signature structure for accurate application traffic classification

Goo, Young-Hoon; Shim, Kyuseok; Lee, Su-Kang; Kim, Myung-Sup

doi:10.1109/apnoms.2016.7737287

Cited by 6 publications

(7 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traditional traffic classification methods include portbased and payload-based analysis methods [4][5][6][7]. The portbased method was performed for applications using fixed port numbers and is not used now because most applications use dynamic ports.…”

Section: A Research Backgroundmentioning

confidence: 99%

“…The signature-based method analyzes common characteristics of traffic generated from target applications and defines them as signatures [5][6][7][8]. The signature-based analysis methods can be defined in various ways according Information on user behavior plays a crucial role in network security and management.…”

Section: A Research Backgroundmentioning

confidence: 99%

“…Third, signature-based methods have been widely used in traffic analysis [4][5][6][7][8][9][10]. However, existing signaturebased methods use only one signature based on analyzed traffic characteristics.…”

Section: B Problem Statementsmentioning

confidence: 99%

See 2 more Smart Citations

User Behavior Detection Using Multi-Modal Signatures of Encrypted Network Traffic

Park,

Shin,

Baek

et al. 2023

IEEE Access

View full text Add to dashboard Cite

With the development of the network environment and the emergence of new applications, network traffic has become increasingly complex. This paper focuses on user behavior detection based on encrypted traffic analysis. User behavior information plays a critical role in network management and security, leading to extensive research in this domain. This paper introduces two main contributions. Firstly, we present a categorization method for application types and a behavior definition approach for user behavior detection research. This enables consistent behavior definition for each application type, facilitating objective performance comparison with other studies in the field. Secondly, a behavior detection method based on Multi-Modal Signatures is introduced. The multi-modal signatures represent the multiple signatures extracted from encrypted traffic, including header, SNI, and PSD signatures, which are subsequently defined as a rule. To validate the effectiveness of our proposed method, we conducted 4 experiments on 5 SaaS applications. As a result of the experiments, the proposed method achieves an F-measure of 94~99%, and can detect other types of application behaviors with high performance. As this study conducts user behavior detection research based on encrypted traffic analysis, the proposed method can be applied to other research areas that utilize encrypted traffic.

show abstract

Section: A Research Backgroundmentioning

confidence: 99%

Section: A Research Backgroundmentioning

confidence: 99%

See 1 more Smart Citation

User Behavior Detection Using Multi-Modal Signatures of Encrypted Network Traffic

Park,

Shin,

Baek

et al. 2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Network traffic consists of header information like ports, IPs, payload length, protocol, etc which are currently used to classify applications [1]. Identification of signature in the payload length is a technique commonly used to classify an application with high accuracy [2][3] [4]. Some researchers found a way to automate the process of signature identification by finding a string or hex subsequence in the payload [5][6].…”

Section: Related Workmentioning

confidence: 99%

Signature Identification and User Activity Analysis on Whatsapp Web through Network Data

Ramraj

Usha

2021

Preprint

View full text Add to dashboard Cite

WhatsApp messenger is a popular instant messaging application that employs end-to-end encryption for communication. WhatsApp Web is the browser-based implementation of WhatsApp messenger. Users of WhatsApp communicate securely using SSL protocol. Encryption and use of common port for communication by multiple applications poses challenge in traffic classification for application identification. It is highly needed to analyze the network traffic for the purpose of QoS, Intrusion Detection and application specific traffic classification. In this paper, we have done traffic analysis on the network packets captured through data transfer in whatsapp web. In the result, we have explored the user activities such as message texting, contact sharing, voice message, location sharing, media transfer and status viewing. Packet level traffic analysis of user activities reveal patterns in the encrypted SSL communication. This pattern is identified across SSL packet lengths for WhatsApp media transfer and voice message communication. Other important features WhatsApp is the ability to view the status of the message being sent. We have identified the read and unread message status in these data packets by exposing signatures in the network layer. These signatures are identified with the help of the SSL lengths in the TLS header information of WhatsApp Web network traffic traces. Various other information on WhatsApp traffic presented in our study is relevant to the version of WhatsApp Web v0.3.2386.

show abstract

“…[3]Lotfollahi, M.added dropout to prevent over fitting and softmax to classify the last layer on the basis of CNN and 5-layer SAE. From Kampeas, J [4]proposed a new set of traffic classification functions for SDN [5] and NFV [6]environments. Very high classification accuracy is achieved by capturing the required data through a single filtering rule and taking only the least feature-dependent part.…”

Section: Introductionmentioning

confidence: 99%

RP-Bert: An approach to detect and classify network intrusions based on a combination of Transfer learning and rules

Sun

Zhang

2023

J. Phys.: Conf. Ser.

View full text Add to dashboard Cite

We investigate the model generalization problem that exists for network traffic intrusion detection. Existing works have begun to apply some advanced algorithms and models from NLP domain to network security domain, but have some challenges. One of the biggest problem is that the amount of data for some existing network intrusions is not sufficient to train the current oversized models. For this purpose, we improve on ET-Bert and propose a method to detect and classify network intrusion based on the combination of migration learning and rules (RP-Bert). And we test and validate it on a large open source dataset BoT-loT, which Recall is achieved, Precision is achieved, F1 Score is achieved, Accuracy is achieved.

show abstract

Payload signature structure for accurate application traffic classification

Cited by 6 publications

References 9 publications

User Behavior Detection Using Multi-Modal Signatures of Encrypted Network Traffic

User Behavior Detection Using Multi-Modal Signatures of Encrypted Network Traffic

Signature Identification and User Activity Analysis on Whatsapp Web through Network Data

RP-Bert: An approach to detect and classify network intrusions based on a combination of Transfer learning and rules

Contact Info

Product

Resources

About