Link Homophily in the Application Layer and its Usage in Traffic Classification

Abstract

Abstract-This paper addresses the following questions. Is there link homophily in the application layer traffic? If so, can it be used to accurately classify traffic in network trace data without relying on payloads or properties at the flow level? Our research shows that the answers to both of these questions are affirmative in real network trace data. Specifically, we define link homophily to be the tendency for flows with common IP hosts to have the same application (P2P, Web, etc.) compared to randomly selected flows. The presence of link homophily in trace data provides us with statistical dependencies between flows that share common IP hosts. We utilize these dependencies to classify application layer traffic without relying on payloads or properties at the flow level. In particular, we introduce a new statistical relational learning algorithm, called Neighboring Link Classifier with Relaxation Labeling (NLC+RL). Our algorithm has no training phase and does not require features to be constructed. All that it needs to start the classification process is traffic information on a small portion of the initial flows, which we refer to as seeds. In all our traces, NLC+RL achieves above 90% accuracy with less than 5% seed size; it is robust to errors in the seeds and various seed-selection biases; and it is able to accurately classify challenging traffic such as P2P with over 90% Precision and Recall.

RocketTC: A high throughput traffic classification architecture

“…Beside software-based solutions [1][2][3][4][5][6][7][8][9][10], recent years, researchers have attempted to employ specialized hardware such as FPGA to accelerate traffic classification.…”

“…They include (1) payload-based method [1][2][3][4][5][6], a.k.a. deep packet inspection (DPI), which relies on searching the packet payload for application-specific signatures, (2) host-based approach [7][8][9] that makes use of transport-layer connection patterns of hosts, and (3) machine learning-based scheme (survey [10]) to classify traffic by recognizing statistical features of flows, such as packet lengths and inter-arrival times statistics.…”

Rapid Exploitation and Analysis of Documents

“…This tendency can be exploited to characterize computer network traffic [35], even in the presence of packet obfuscation.…”

Efficient Methods for Early Protocol Identification

“…Finally, approach (iii) is based on the analysis of host behavior instead of individual network connections. The basic idea behind this solution is that different applications or application groups have different communication habits, for example, a client application has few outgoing connections, a server has numerous incoming connections, while P2P applications have many connections in both directions, giving rise to methods analyzing the connection patterns of host interactions [6], [7] or utilizing the assumption that similar hosts tend to be related to one another [8].…”