Speeding-Up DPI Traffic Classification with Chaining

Doroud, Hossein; Aceto, Giuseppe; Donato, Walter de; Jarchlo, Elnaz Alizadeh; Marín, Andrés; Guerrero, Cesar D.; Pescapè, Antonio

doi:10.1109/glocom.2018.8648137

Cited by 22 publications

(8 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The testing of the nDPI system in practice has confirmed the high efficiency and accuracy of protocol detection. Another paper [40] proposes a practical approach for improving the efficiency of traditional traffic classification methods by consistently passing the rapid classification stages (based on ports and machine learning). Although the proposed method reduces false positives and is more accurate, it requires significant time and resources when developing a DPI system.…”

Section: Background On Dpi Systemmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

In this paper, to solve the problem of detecting network anomalies, a method of forming a set of informative features formalizing the normal and anomalous behavior of the system on the basis of evaluating the Hurst (H) parameter of the network traffic has been proposed. Criteria to detect and prevent various types of network anomalies using the Three Sigma Rule and Hurst parameter have been defined. A rescaled range (RS) method to evaluate the Hurst parameter has been chosen. The practical value of the proposed method is conditioned by a set of the following factors: low time spent on calculations, short time required for monitoring, the possibility of self-training, as well as the possibility of observing a wide range of traffic types. For new DPI (Deep Packet Inspection) system implementation, algorithms for analyzing and captured traffic with protocol detection and determining statistical load parameters have been developed. In addition, algorithms that are responsible for flow regulation to ensure the QoS (Quality of Services) based on the conducted static analysis of flows and the proposed method of detection of anomalies using the parameter Hurst have been developed. We compared the proposed software DPI system with the existing SolarWinds Deep Packet Inspection for the possibility of network traffic anomaly detection and prevention. The created software components of the proposed DPI system increase the efficiency of using standard intrusion detection and prevention systems by identifying and taking into account new non-standard factors and dependencies. The use of the developed system in the IoT communication infrastructure will increase the level of information security and significantly reduce the risks of its loss.

show abstract

Section: Background On Dpi Systemmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…AUC calculates the area under the curve between TPR and FPR values both equal to 0 and 1 (0, 0) and (1, 1) using integral calculus. The higher is the value of AUC; the better is the class's separability of the algorithm [41].…”

Section: ) Performance Metricsmentioning

confidence: 99%

Online Data Center Traffic Classification Based on Inter-Flow Correlations

et al. 2020

View full text Add to dashboard Cite

Today, increasing attention is being paid to Data Center (DC) traffic classification since these infrastructures have become the heart of a variety of time-sensitive and data-intensive service platforms. Classification provides the required tools for better understanding traffic patterns in order to ensure high Quality of Service (QoS) performances and solve scalability problems. Unfortunately, existing classification algorithms cannot deal efficiently with two critical challenges in DC traffic: inter-class imbalance and critical time constraints. In this paper, we propose a novel correlation-based algorithm following a cost-sensitive approach combined with a Bagged Random Forest (BRF) ensemble algorithm, to address the inter-class imbalance problem while meeting time requirements in a data center environment. In this strategy, a new method based on Reverse k-Nearest Neighbors (RkNN) is proposed to capture the rebalancing weights expressing inter-flow correlations, in order to perform an online classification approach. We demonstrate the efficiency of the algorithm by comparing its performance to several existing methods from data level, algorithm level, and cost-sensitive strategies on four real-world datasets. The results reveal that the proposed algorithm outperforms most approaches in the different datasets in terms of precision, recall, F1 measure, AUC and Kappa, as opposed to other algorithms that result in either high precision with low recall and low precision and high recall causing congestion or resource over provisioning.

show abstract

“…In [27], chaining fast classification stages (port-based and machine learning-based) based on DPI was proposed to speed up DPI traffic classification. This method classifies network traffic 45% faster than nDPIng, a state-of-the-art DPI classifier, with comparable classification performance.…”

Section: Deep Packet Inspection (Dpi)mentioning

confidence: 99%

Fast Packet Inspection for End-To-End Encryption

et al. 2020

View full text Add to dashboard Cite

With the recent development and popularization of various network technologies, communicating with people at any time, and from any location, using high-speed internet, has become easily accessible. At the same time, eavesdropping, data interception, personal data leakage, and distribution of malware during the information transfer process have become easier than ever. Recently, to respond to such threats, end-to-end encryption (E2EE) technology has been widely implemented in commercial network services as a popular information security system. However, with the use of E2EE technology, it is difficult to check whether an encrypted packet is malicious in an information security system. A number of studies have been previously conducted on deep packet inspection (DPI) through trustable information security systems. However, the E2EE is not maintained when conducting a DPI, which requires a long inspection time. Thus, in this study, a fast packet inspection (FPI) and its frame structure for quickly detecting known malware patterns while maintaining E2EE are proposed. Based on the simulation results, the proposed FPI allows for inspecting packets approximately 14.4 and 5.3 times faster, respectively, when the inspection coverage is 20% and 100%, as compared with a DPI method under a simulation environment in which the payload length is set to 640 bytes.

show abstract

Speeding-Up DPI Traffic Classification with Chaining

Cited by 22 publications

References 23 publications

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Online Data Center Traffic Classification Based on Inter-Flow Correlations

Fast Packet Inspection for End-To-End Encryption

Contact Info

Product

Resources

About