KISS: Stochastic Packet Inspection Classifier for UDP Traffic

Abstract

This paper proposes KISS, a novel Internet classification engine. Motivated by the expected raise of UDP traffic, which stems from the momentum of Peer-to-Peer (P2P) streaming applications, we propose a novel classification framework that leverages on statistical characterization of payload. Statistical signatures are derived by the means of a Chi-Square ( 2 )-like test, which extracts the protocol "format," but ignores the protocol "semantic" and "synchronization" rules. The signatures feed a decision process based either on the geometric distance among samples, or on Support Vector Machines. KISS is very accurate, and its signatures are intrinsically robust to packet sampling, reordering, and flow asymmetry, so that it can be used on almost any network. KISS is tested in different scenarios, considering traditional client-server protocols, VoIP, and both traditional and new P2P Internet applications. Results are astonishing. The average True Positive percentage is 99.6%, with the worst case equal to 98.1,% while results are almost perfect when dealing with new P2P streaming applications.

Unmasking the Growing UDP Traffic in a Campus Network

“…Hence network engineering research has been based on the dominance of TCP traffic [5][6][7]. Traffic classification has also concentrated on identifying TCP applications, and only a few popular UDP applications such as PPLive and SopCast have been studied [8,9]. In addition, network experiments with synthetic traffic have mostly focused on generating realistic TCP traffic while they often model UDP traffic as simple packet bunches sent at constant bit rate [24].…”

A class-oriented feature selection approach for multi-class imbalanced network traffic datasets based on local and global metrics fusion

“…In the first part (1-4), it calculates the WSU value of each feature on NS, and inserts each feature into list in descending order according to their WSU values. In the second part (5)(6)(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19), it further processes the ordered list to remove redundant features and only keeps predominant ones among all the selected features. A feature f p that has been determined to be a predominant feature can always be used to filter out other features that are ranked lower than f p .…”

“…These techniques can deal with above limitations by avoiding deep packet inspection and creating new features from transport layer statistics (e.g., packet size and interarrival time) [11][12][13][14]. A variety of features have been extracted from traffic flows in recent years.…”

IP packet interleaving for UDP bursty losses

“…Our choice is motivated by the expected rise of UDP traffic volume [49,50,51,52], which steps from the momentum of applications (e.g. DNS, VoIP, streaming, p2p IPTV, etc.…”