Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey

Sheikh, Muhammad Sameer; Peng, Yinqiao

doi:10.1109/access.2022.3181135

Cited by 22 publications

(22 citation statements)

References 132 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several methods for traffic classification exist, each handling traffic information differently. These techniques are port-based classification, payload-based classification, statistical-based classification, behavioral-based classification, and correlation-based classification [36,37].…”

Section: Traffic Classification Techniquementioning

confidence: 99%

See 1 more Smart Citation

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Holasova,

Fujdiak,

Misurec

2024

Algorithms

View full text Add to dashboard Cite

The interconnection of Operational Technology (OT) and Information Technology (IT) has created new opportunities for remote management, data storage in the cloud, real-time data transfer over long distances, or integration between different OT and IT networks. OT networks require increased attention due to the convergence of IT and OT, mainly due to the increased risk of cyber-attacks targeting these networks. This paper focuses on the analysis of different methods and data processing for protocol recognition and traffic classification in the context of OT specifics. Therefore, this paper summarizes the methods used to classify network traffic, analyzes the methods used to recognize and identify the protocol used in the industrial network, and describes machine learning methods to recognize industrial protocols. The output of this work is a comparative analysis of approaches specifically for protocol recognition and traffic classification in OT networks. In addition, publicly available datasets are compared in relation to their applicability for industrial protocol recognition. Research challenges are also identified, highlighting the lack of relevant datasets and defining directions for further research in the area of protocol recognition and classification in OT environments.

show abstract

Section: Traffic Classification Techniquementioning

confidence: 99%

“…The method is based on examining packet headers and comparing port numbers of registered applications. Examining only the packet headers presents a fast and simple classification [36]. This type of classification is especially important for identifying network applications in large network traffic [36].…”

Section: Traffic Classification Techniquementioning

confidence: 99%

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Holasova,

Fujdiak,

Misurec

2024

Algorithms

View full text Add to dashboard Cite

show abstract

“…Behavior features refer to the observable data behaviors or user behaviors in communication system [11]. Statistical features are extracted by statistical analysis of protocol data stream [12].…”

Section: A Related Workmentioning

confidence: 99%

Deep Learning Based Identification Method for Signal-Level Wireless Protocol

Ren

Song

et al. 2022

IEEE Access

View full text Add to dashboard Cite

Electromagnetic spectrum surveillance is the basis of space environment monitoring and management, while protocol identification is one of the most important methods. Protocol identification has been applied in many fields, such as target recognition, anomaly detection, security management and information countermeasure. In the past decade, a lot of deep learning based protocol identification methods have been proposed, based on the bit-level protocol. However, the data needs to be demodulated and decoded, depending on the prior information of the target system. In this paper, we focus on signal-level protocol, and introduce the deep learning based identification method. We first develop a multi-dimensional convolutional neural network based method for feature extraction of signal-level protocol. Then, a spatial pooling convolutional neural network is introduced for variable length protocol identification. At last, an unsupervised training network is proposed for feature extraction of unlabelled signal-level protocol. The proposed methods are evaluated by using the practical wireless protocols, and the effectiveness is verified by simulation results.

show abstract

“…For the purposes of this paper, we used the NSL-KDD dataset, which is a refined version of its predecessor KDD’99, a well-known benchmark in the research on intrusion detection techniques [ 6 , 9 , 10 , 11 , 12 , 13 ]. This labeled dataset is split into training and testing files and can be downloaded from [ 12 ].…”

Section: Introductionmentioning

confidence: 99%

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network

Mari

Zinca

Dobrota

2023

Sensors

View full text Add to dashboard Cite

Intrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied, several machine learning-based IDSs have been developed. In this study, we focused on one such model involving several algorithms and used the NSL-KDD dataset as a benchmark to train and evaluate its performance. We demonstrate a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN)—i.e., an architecture based on a deep-learning algorithm capable of creating generative models—was implemented. Furthermore, we tested the IDS performance using the generated adversarial traffic. The results showed that, even in the case of the GAN-generated traffic (which could successfully evade IDS detection), by using the adversarial traffic in the testing process, we could improve the machine learning-based IDS performance.

show abstract

Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey

Cited by 22 publications

References 132 publications

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

Deep Learning Based Identification Method for Signal-Level Wireless Protocol

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network

Contact Info

Product

Resources

About