Real-time traffic classification based on statistical tests for matching signatures with packet length distributions

Neto, Miguel; Gomes, João L.; Freire, Mário M.; Inácio, Pedro R. M.

doi:10.1109/lanman.2013.6528276

Cited by 4 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The features used as entrance to our classification were relative frequencies and accumulated frequencies. The results obtained through SVM were compared to the Kolmogorov-Smirnov(KS) and Chi-squared tests [30]. KS was used with the aim to select the distribution that best represents the applications (flows).…”

Section: Classification Resultsmentioning

confidence: 99%

See 1 more Smart Citation

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

Cunha

Magoni

Inácio

et al. 2022

Advanced Information Networking and Applications

View full text Add to dashboard Cite

Home users are increasingly acquiring, at lower prices, electronic devices such as video cameras, portable audio players, smartphones, and video game devices, which are all interconnected through the Internet. This increase in digital equipment ownership induces a massive production and sharing of multimedia content between these users. The supervised learning machine method Support Vector Machine (SVM) is vastly used in classification. It is capable of recognizing patterns of samples of predefined classes and supports multi-class classification. The purpose of this article is to explore the classification of multimedia P2P traffic using SVMs. To obtain relevant results, it is necessary to properly adjust the so-called Self C parameter. Our results show that SVM with linear kernel leads to the best classification results of P2P video with an F-Measure of 99% for C parameter ranging from 10 to 70 and to the best classification results of P2P file-sharing with an F-Measure of 98% for C parameter ranging from 30 to 70. We also compare these results with the ones obtained with Kolmogorov-Smirnov (KS) tests and Chi-square tests. It is shown that SVM with linear kernel leads to a better classification performance than KS and chi-square tests, which reached an F-Measure of 67% and 70% for P2P filesharing and P2P video, respectively, for KS test, and reached an F-Measure of 85% for both P2P file-sharing and P2P video for chi-square test. Therefore, SVM with linear kernel and suitable values for the Self C parameter can be a good choice for identifying encrypted multimedia P2P traffic on the Internet.

show abstract

Section: Classification Resultsmentioning

confidence: 99%

“…On the other hand, Chi-squared test [31] was used to compare the relative frequency distribution to the relative frequency of a distribution previously selected that represents a traffic or application class. KS is defined by [30]:…”

Section: Classification Resultsmentioning

confidence: 99%

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

Cunha

Magoni

Inácio

et al. 2022

Advanced Information Networking and Applications

View full text Add to dashboard Cite

show abstract

“…In Table 12, there is a summary of works around those tests. Neto et al [152] represented traffic classes by using empirical distributions that correspond to the traffic classes signatures, aiming to develop a classifier based in the dark mechanism that combined both Kolmogorov-Smirnov and Chi-square tests. Chi-square was also used in [153] to test if a set of data follows a specific distribution with a degree of confidence.…”

Section: ) Correlation Informationmentioning

confidence: 99%

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

et al. 2022

View full text Add to dashboard Cite

Internet traffic classification aims to identify the kind of Internet traffic. With the rise of traffic encryption and multi-layer data encapsulation, some classic classification methods have lost their strength. In an attempt to increase classification performance, Machine Learning (ML) strategies have gained the scientific community interest and have shown themselves promising in the future of traffic classification, mainly in the recognition of encrypted traffic. However, some of these methods have a high computational resource consumption, which make them unfeasible for classification of large traffic flows or in real-time. Methods using statistical analysis have been used to classify real-time traffic or large traffic flows, where the main objective is to find statistical differences among flows or find a pattern in traffic characteristics through statistical properties that allow traffic classification. The purpose of this work is to address statistical methods to classify Internet traffic that were little or unexplored in the literature. This work is not generally focused on discussing statistical methodology. It focuses on discussing statistical tools applied to Internet traffic classification Thus, we provide an overview on statistical distances and divergences previously used or with potential to be used in the classification of Internet traffic. Then, we review previous works about Internet traffic classification using statistical methods, namely Euclidean, Bhattacharyya, and Hellinger distances, Jensen-Shannon and Kullback-Leibler (KL) divergences, Support Vector Machines (SVM), Correlation Information (Pearson Correlation), Kolmogorov-Smirnov and Chi-Square tests, and Entropy. We also discuss some open issues and future research directions on Internet traffic classification using statistical methods.

show abstract

“…Significant research efforts have been carried out on the subjects of identification and classification of Internet traffic. Part of them rely on statistics, see, e.g, [5,7]. Recent research still focuses on making improvements using machine learning, such as [1].…”

Section: Related Workmentioning

confidence: 99%

“…Statistical tests such as Chi-Squared and Kolmogorov-Smirnov were used for traffic classification in [7], representing the classes through the corresponding signatures and the empirical distributions. The entropy was also used to measure and represent important differences regarding packet heterogeneity [8].…”

Section: Related Workmentioning

confidence: 99%

Classification of Encrypted Internet Traffic Using Kullback-Leibler Divergence and Euclidean Distance

Cunha

Zavala

Inácio

et al. 2020

Advanced Information Networking and Applications

View full text Add to dashboard Cite

The limitations of traditional classification methods based on port number and payload inspection to classify encrypted or obfuscated Internet traffic, often with randomized port numbers, have lead to significant research efforts focusing on classification approaches based on Machine Learning techniques using Transport Layer statistical features. However, these approaches also have their own limitations, leading to the study of a set of other alternative approaches, including statisticsbased approaches. Statistical approaches can be an alternative to machine learning, because in real-time traffic classification with new types of data, the entire traffic classifier has to be retrained in order to adapt to the new change by combining the old training data with the new training data. This article investigates the classification of encrypted traffic using statistical methods applied to network traffic classification. We propose two statistical classifiers for encrypted Internet traffic based on Kullback Leibler divergence and Euclidean distance, which are computed using the flow and packet size obtained from some of the protocols used by applications. In our experiments, we evaluate the two classifiers based on statistical methods and compare them with a classifier based on Support Vector Machine (SVM). During our study, we were able to classify the traffic by using few features without compromising the performance of the classifier. The experimental results illustrate the effectiveness of our models used for traffic classification.

show abstract

Real-time traffic classification based on statistical tests for matching signatures with packet length distributions

Cited by 4 publications

References 19 publications

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

Impact of Self C Parameter on SVM-based Classification of Encrypted Multimedia Peer-to-Peer Traffic

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

Classification of Encrypted Internet Traffic Using Kullback-Leibler Divergence and Euclidean Distance

Contact Info

Product

Resources

About