Abstract:Application identification plays an essential role in network management such as intrusion detection and security monitoring. But the continuous growth of bandwidth and massive amount of packets pose serious challenges for efficacious and accurate application identification. In this paper, we develop a new method to reduce the number of packets being processed while achieving the goal of accurate P2P and VoIP application identification. Firstly, we employ the Bi-flow model to aggregate traffic packets into Bi-flow, which can capture the exchange behavior characteristics between different terminals. Then we employ the signature of Packet Size Distribution (PSD) to capture flow dynamics, which is defined as the payload length distribution probability of the packets in one Bi-flow. Secondly, we collect PSD of several different P2P and VoIP applications and the analysis results show that PSD of different applications are different with each other, which can be used as features to perform traffic identification. We also find the PSD characteristics of one Bi-flow can be captured by its first few packets, which demonstrate our methods can identify the Bi-flow quickly after its establishment. We employ the Renyi cross entropy to perform identification by calculating the similarity between PSD of the Bi-flow being identified and that of specific application. If the similarity is higher than a selected threshold, the Bi-flow being identified is classified to the specific application. Finally, as the PSD is a type of probability feature which is not sensitive to packet lose, we integrate the Poisson sampling method into our framework to process the massive data in backbone networks. Experimental results using the artificial and actual traces collected from monitoring platform in the Northwest Center of CERNET (China Education and Research Network) verify the accuracy and robustness of our method.

MP-ROOM: Optimal Matching on Multiple PDUs for Fine-Grained Traffic Identification

ROOM: Rule Organized Optimal Matching for fine-grained traffic identification

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

P4CTM: Compressed Traffic Pattern Matching Based on Programmable Data Plane

MTP: Avoiding Control Plane Overload with Measurement Task Placement

A Design and Implementation of P2p Network Traffic Identification System

MiCuts: Combing Bit-Based Cutting and Splitting for Efficient Packet Classification

FROD: an Efficient Framework for Optimizing Decision Trees in Packet Classification

Cufti: Methods for Core Users Finding and Traffic Identification in P2p Systems

An ultra high throughput and memory efficient pipeline architecture for multi-match packet classification without TCAMs.

High-Throughput and Memory-Efficient Multimatch Packet Classification Based on Distributed and Pipelined Hash Tables.

Real-Time P2P Traffic Identification

Ultra-High Throughput String Matching for Deep Packet Inspection

Tracking Millions of Flows in High Speed Networks for Application Identification

A Peer-To-Peer Traffic Identification Method Using Machine Learning

An Observation of Packet Classification: Most Rules Are at the Top

MPTCP Meets Big Data: Customizing Transmission Strategy for Various Data Flows

Robust Application Identification Methods for P2P and VoIP Traffic Classification in Backbone Networks

Path‐flow Matching: Two‐sided Matching and Multiobjective Evolutionary Algorithm for Traffic Scheduling in Cloud Data* Center Network

A New Method of P2P Traffic Identification Based on Support Vector Machine at the Host Level

Traffic-Aware Routing for Real-Time Communications in Wireless Multi-Hop Networks