Abstract:Application traffic signatures are byte subsequences or behaviors (such as packet sizes and interval times) within traffic that can distinguish which application is contributing to the network traffic, application traffic signatures form the building blocks of many constructions of deep packet analysis rules in numerous areas, such as network management, measurement, and even security systems. Under the pressure of the continual appearance of new applications and their frequent updates, how to efficiently and accurately extract signatures from network traffic becomes a more challenging issue. Although several generating methods have been proposed, because of the problems of efficiency, robustness, and refinement, the application of these methods in real network environments still has limitations. Existing CS (Common Subsequence) based approaches are ineffective in generating signatures from network traffic, especially when the network traffic is massive. In this paper, we propose ESGS, an efficient system to extracts signatures from application traffic traces. ESGS base on the Latent Dirichlet Allocation (LDA) and a modified sequence pattern algorithm. First, we use a semantic analysis algorithm based on the LDA to select the candidate packet from the traffic traces according to the semantic information of the packet and refine the traffic traces. Then, we use a modified sequence pattern algorithm to generate signatures in the filtered traffic trace. We compare ESGS with several existing generating methods via evaluation on real-world application traffic traces. The result shows that ESGS can generate application traffic signatures significantly faster, and the signatures perform high accuracy. In addition, this method can effectively reduce the input traffic of signature generation systems such as Sigbox, and significantly improve the efficiency of signature generation while having a little impact on accuracy.

Harvesting unique characteristics in packet sequences for effective application classification

An Efficient Application Traffic Signature Generation System

AutoSig-Automatically Generating Signatures for Applications

Automatically Mining Application Signatures for Lightweight Deep Packet Inspection

Application traffic classification based on command exchange mode of TCP flows

Traffic Classification - Towards Accurate Real Time Network Applications

Sequential Message Characterization for Early Classification of Encrypted Internet Traffic

Characterizing Application Behaviors for Classifying P2p Traffic

Robust Application Identification Methods for P2P and VoIP Traffic Classification in Backbone Networks

Accelerating Application Identification with Two-Stage Matching and Pre-Classification

Automatic Discovery of Protocol Signatures

Identification Of P2p Traffic Based On The Content Redistribution Characteristic

Leveraging Inner-Connection of Message Sequence for Traffic Classification: A Deep Learning Approach

Composite Lightweight Traffic Classification System for Network Management

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

An ultra high throughput and memory efficient pipeline architecture for multi-match packet classification without TCAMs.

An SVM-based machine learning method for accurate internet traffic classification

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Network Traffic Classification Algorithm Based on Spectral Clustering

SkyTracer: Towards fine-grained identification for Skype traffic via sequence signatures

A Multi-Scale Feature Attention Approach to Network Traffic Classification and Its Model Explanation