Session level flow classification by packet size distribution and session grouping

Lu, Chun-Nan; Huang, Chun-Ying; Lin, Ying-Dar; Lai, Yuan‐Cheng

doi:10.1016/j.comnet.2011.09.007

Cited by 28 publications

(12 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The clustering process is performed while using the same features. Related work also presents a process of categorizing network traffic data at the session layer . At the session layer, time and size are essential, but the analysis process has more impact on the application layer.…”

Section: Preliminaries and Backgroundmentioning

confidence: 99%

On detecting unidentified network traffic using pattern-based random walk

Nia

Atani

Fabian

et al. 2016

Security Comm. Networks

View full text Add to dashboard Cite

This paper presents a new approach to network traffic control based on the pattern theorem. In order to generate unique detection patterns for the process of traffic analysis, a self‐avoiding walk algorithm is used. During data processing and analysis, the traffic patterns are adapted dynamically in real‐time. The modified traffic patterns are systematically analyzed using a threat database. In this work, a threshold is set to distinguish and trigger critical levels of threats. The matching process is terminated under each of the three conditions: (i) pattern matching rate is up to 80%; (ii) pattern matching rates of at least five various threats are up to 50%; and (iii) pattern matching is enhanced up to 50% for each matched pattern using an implicit combination of threat coefficients. Our experimental results show that in the worst‐case scenario, the true detection rate of malicious traffic is higher than 69%, and in the best situation, it would be about 95% for the same malicious traffic. Also, the precision of false detection for trusted patterns is negligible. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Section: Preliminaries and Backgroundmentioning

confidence: 99%

On detecting unidentified network traffic using pattern-based random walk

Nia

Atani

Fabian

et al. 2016

Security Comm. Networks

View full text Add to dashboard Cite

show abstract

“…However, port-based application classification has limitations: not all applications are registered in IANA. Many application classification mechanisms have been proposed [19][20][21][22][23][24]. We follow the classification presented in [19] and choose the typical classes as in Table 1 (3) Requirements for video: real time and high bandwidth applications.…”

Section: Application's Qos Requirements Application's Qosmentioning

confidence: 99%

QoS-Based Path Switching Mechanism in Mobile SCTP

Han

Sun

Joó

et al. 2014

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

In mobile SCTP, a mobile terminal has two or more network interfaces and vertical handover occurs when it moves from one network to another. The delay due to the handover process and the slow-start phase of SCTP's congestion control after handover cause substantial performance degradation. If the mobile node goes back and forth frequently, excessive handovers occur and data transmission quality deteriorates. In order to provide the required level of QoS for on-going application, the frequency of handovers should be kept minimized. In this paper, we propose a transport layer handover mechanism using the mobile SCTP. We take the QoS requirements of application as the major criterion in deciding path switching. In our mechanism, the mobile node in overlapping area does not perform handover if the current network metrics satisfy the QoS requirements of on-going application. Both analytic evaluation and simulation results show that the proposed mechanism significantly improves the throughput by suppressing unnecessary handovers. Our research results can also be applied to distributed mobile sensor networks.

show abstract

“…Ying-Dar Lin et al use the port association to assist traffic classification. They found that the operating system will assign continuous port numbers when an application has to setup several connections with remote host [10]. This heuristic can speed up traffic classification, but it is an auxiliary method and cannot classify all traffic.…”

Section: Related Workmentioning

confidence: 99%

“…According to [10], when an application initializes a number of connections with other hosts actively, operating system allocates consecutive port numbers although the first port number is chosen randomly. We found the same allocation in P2P applications.…”

Section: Application(type) Signature Stringsmentioning

confidence: 99%

Two-Step P2P Traffic Classification with Connection Heuristics

Cho

2013

2013 Seventh International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing

View full text Add to dashboard Cite

The basis of P2P traffic control is to classify P2P traffic accurately. Several methods such as port-based, signature-based, pattern-based and statistics-based method have been proposed for P2P traffic classification. However, as P2P applications have tried to avoid being easily detected, it becomes hard to classify P2P traffic accurately using only one method. In this paper, we propose an improved two-step P2P traffic classifier by combining signature-based classifier with connection heuristics in packet-level, and statistics-based classifier in flow-level. With connection heuristics, our scheme detects P2P traffic quickly in packet-level classification and reduces the amount of computation. Through verification with real datasets, we show that our two-step scheme has high accuracy and low overhead compared to simple combination of signature-based scheme and statistics-based scheme.

show abstract

Session level flow classification by packet size distribution and session grouping

Cited by 28 publications

References 16 publications

On detecting unidentified network traffic using pattern-based random walk

On detecting unidentified network traffic using pattern-based random walk

QoS-Based Path Switching Mechanism in Mobile SCTP

Two-Step P2P Traffic Classification with Connection Heuristics

Contact Info

Product

Resources

About