Abstract:Network traffic classification, which can map network traffic to protocols in the application layer, is a fundamental technique for network management and security issues such as Quality of Service, network measurement, and network monitoring. Recent researchers focus on extracting features for traditional machine learning methods from flows or datagrams of the specific protocol. However, as the rapid growth of network applications, previous works cannot handle complex novel protocols well. In this paper, we introduce the recurrent neural network to network traffic classification and design a novel neural network, the Byte Segment Neural Network (BSNN). BSNN treats network datagrams as input and gives the classification results directly. In BSNN, a datagram is firstly broken into serval byte segments. Then, these segments are fed to encoders which are based on the recurrent neural network. The information extracted by encoders is combined to a representation vector of the whole datagram. Finally, we apply the softmax function to use this vector for predicting the application protocol of this datagram. There are several key advantages of BSNN: 1) no need for prior knowledge of target applications; 2) can handle both connection-oriented protocols and connection-less protocols; 3) supports multi-classification for protocols; 4) shows outstanding accuracy in both traditional protocols and complex novel protocols. Our thorough experiments on real-world data with different protocols indicate that BSNN gains average F1-measure about 95.82% in multi-classification for five protocols including QQ, PPLive, DNS, 360 and BitTorrent. And it also shows excellent performance for detection of novel protocols. Furthermore, compared with two recent state-of-the-art works, BSNN has superiority over the traditional machine learning-based method and the packet inspection method.

PPP: Towards Parallel Protocol Parsing

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Building High-Performance Application Protocol Parsers on Multi-core Architectures

Efficient Parallelization Of Regular Expression Matching For Deep Inspection

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

Application traffic classification based on command exchange mode of TCP flows

Composite Lightweight Traffic Classification System for Network Management

Network Softwarization and Parallel Networks: Beyond Software-Defined Networks

Research and Implementation of Efficient DPI Engine Base on DPDK

Hybrid Internet Traffic Classification Technique

PPP Conformance Testing Research

PARNEM-A PARALLEL DISCRETE EVENT NETWORK EMULATION SYSTEM

Research and Implementation of a Parallel Discrete Event Network Emulator

A Survey of Semantic Parsing Techniques

Packet Classification Algorithms: from Theory to Practice

Byte Segment Neural Network for Network Traffic Classification

Fast String Matching with Overlapped Substring Classifier in Deep Packet Inspection Systems

DS-PPS: A Practical Framework to Guarantee Differentiated QoS in Terabit Routers with Parallel Packet Switch

A Multi-Table Programmable Parser for Satellite Networks

Parallel Dfa Architecture For Ultra High Throughput Dfa-Based Pattern Matching

Study of IP Classification Technology