Abstract:Application identification plays an essential role in network management such as intrusion detection and security monitoring. But the continuous growth of bandwidth and massive amount of packets pose serious challenges for efficacious and accurate application identification. In this paper, we develop a new method to reduce the number of packets being processed while achieving the goal of accurate P2P and VoIP application identification. Firstly, we employ the Bi-flow model to aggregate traffic packets into Bi-flow, which can capture the exchange behavior characteristics between different terminals. Then we employ the signature of Packet Size Distribution (PSD) to capture flow dynamics, which is defined as the payload length distribution probability of the packets in one Bi-flow. Secondly, we collect PSD of several different P2P and VoIP applications and the analysis results show that PSD of different applications are different with each other, which can be used as features to perform traffic identification. We also find the PSD characteristics of one Bi-flow can be captured by its first few packets, which demonstrate our methods can identify the Bi-flow quickly after its establishment. We employ the Renyi cross entropy to perform identification by calculating the similarity between PSD of the Bi-flow being identified and that of specific application. If the similarity is higher than a selected threshold, the Bi-flow being identified is classified to the specific application. Finally, as the PSD is a type of probability feature which is not sensitive to packet lose, we integrate the Poisson sampling method into our framework to process the massive data in backbone networks. Experimental results using the artificial and actual traces collected from monitoring platform in the Northwest Center of CERNET (China Education and Research Network) verify the accuracy and robustness of our method.

A Semi-Supervised Clustering Method for Network Application Flow Classification

Information Entropy Based Clustering Method for Unsupervised Internet Traffic Classification

An Efficient Sampling And Classification Approach For Flow Detection In Sdn-Based Big Data Centers

Network Traffic Classification Via Non-Convex Multi-Task Feature Learning

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

Traffic Classification - Towards Accurate Real Time Network Applications

Network Traffic Classification Algorithm Based on Spectral Clustering

Application traffic classification based on command exchange mode of TCP flows

A traffic classification approach based on characteristics of subflows and ensemble learning

Clustering Network Traffic Using Semi-Supervised Learning

Feature Selection For Classifying Data Stream Based On Maximum Entropy

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

A Constrained Feature Selection Approach Based on Feature Clustering and Hypothesis Margin Maximization

A Network Traffic Classification Method Based on Graph Convolution and LSTM

Robust Application Identification Methods for P2P and VoIP Traffic Classification in Backbone Networks

A feature selection-based method for DDoS attack flow classification

UDP Traffic Classification Using Most Distinguished Port

Flow-awared Identification Model of Sophisticated Network Application

L2-BiTCN-CNN: Spatio-temporal features fusion-based multi-classification model for various internet applications identification

Addressing the Train-Test Gap on Traffic Classification Combined Subflow Model with Ensemble Learning