Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling

González-Castaño, Francisco J.; Rodríguez-Hernández, Pedro S.; Martinez-Alvarez, R. P.; Gómez, A.

doi:10.1007/978-3-540-71629-7_24

Cited by 2 publications

(8 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to their high port rates, those routers cannot extract the headers of all the packets that traverse them, but only a sample. The results in this paper suggest that nonlinear support vector machines are highly successful and outperform recent approaches like [1,2]. …”

mentioning

confidence: 72%

“…Reference [7] also uses SVMs to detect anomalous traffic, but it focuses on intrusion attacks instead of p2p traffic identification. In [2] we demonstrated that linear support vector machine detection of p2p traffic in high-performance routers with packet sampling is highly successful and outperforms recent approaches like [1]. In this paper we evaluate nonlinear support vector machines for the same purpose.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling: Nonlinear Kernel Approach

González-Castaño

Rodríguez-Hernández

Martinez-Alvarez

et al. 2007

Computational Science – ICCS 2007

View full text Add to dashboard Cite

Abstract. In this paper, we apply nonlinear support vector machines to identify peer-to-peer (p2p) traffic in high-performance routers with packet sampling. Due to their high port rates, those routers cannot extract the headers of all the packets that traverse them, but only a sample. The results in this paper suggest that nonlinear support vector machines are highly successful and outperform recent approaches like [1,2].

show abstract

mentioning

confidence: 72%

Section: Introductionmentioning

confidence: 99%

Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling: Nonlinear Kernel Approach

González-Castaño

Rodríguez-Hernández

Martinez-Alvarez

et al. 2007

Computational Science – ICCS 2007

View full text Add to dashboard Cite

show abstract

“…In [67,68], the authors focus on classifying P2P traffic only. In [67], the authors accomplish this by inputting transport-level flow statistics to a two stage classifier.…”

Section: Support Vector Machines (Svms)mentioning

confidence: 99%

“…In [68], González-Castaño et al propose a solution to identify P2P on high speed routers. They argue that even when you sample packets you can achieve a high accuracy rate for identifying P2P traffic using a SVM.…”

Section: Support Vector Machines (Svms)mentioning

confidence: 99%

See 1 more Smart Citation

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

Classifying Internet traffic flows online into applications or broader classes without inspecting the packet payloads or without relying on port numbers has become a necessity for network operators. The operators can use this information to monitor their networks and provide per-class quality of service. There has been a great deal of research done on Internet traffic classification recently and numerous techniques have been proposed. While the current techniques can obtain a high accuracy classifying Internet traffic, providing performance guarantees for particular classes of interest has never been addressed. In this thesis, we provide two novel types of online Internet traffic classifiers that can provide performance guarantees on the false alarm and false discovery rates, respectively. These guarantees can be for an entire class (class-wise) or between two classes (pair-wise). Controlling false alarm rates is well-suited for application prioritization (i.e. prioritizing time-sensitive applications like VoIP over HTTP) whereas controlling false discovery rates is better suited for blocking or rate-limiting a targeted class of traffic (i.e. Peer-to-Peer). The classifier that provides false alarm rate guarantees is based on a Neyman-Pearson classification framework while the classifier that provides false discovery rate guarantees is based on the Learning to Satisfy (LSAT) framework. Both of these classifiers are implemented using a machine learning technique, namely, the 2-nu Support Vector Machine (SVM). Moreover, all previous work done with these two statistical methodologies focused on binary classification only; we extend these statistical methodologies to a multi-class setting. In addition to the regular application classification problem, we also present preliminary work on a binary LSAT classifier that can detect, after the reception of only a handful of packets, whether a flow will be large, as defined by a network operator. This large flow detector can act as a preprocessor for regular application classifiers. By allowing only large flows to pass to the classifier, this allows the classifier to focus on the more resource-intensive flows. We validated our Internet traffic classifiers by testing our approaches using data provided by an ISP.ii Abrégé Identifier l'application (ou autre classe plus générale) qui génère un flux de trafic Internet, sans compter sur le numéro du port ou inspecter la charge des paquets, est devenu une nécessité pour les opérateurs de réseau. Les opérateurs peuvent utiliser cette information pour surveiller leurs réseaux et fournir une qualité de service propreà chaque classe. Il y a eu beaucoup de travaux de recherche portant sur la classification du trafic Internet effectué récemment et de nombreuses techniques ontété proposées. Bien que les techniques actuelles puissent obtenir une grande précision pour classer le trafic Internet, offrir des garanties de performance pour des catégories particulières est un problème encore inexploré.Dans ce mémoire, nous proposons deu...

show abstract

Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling

Cited by 2 publications

References 7 publications

Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling: Nonlinear Kernel Approach

Support Vector Machine Detection of Peer-to-Peer Traffic in High-Performance Routers with Packet Sampling: Nonlinear Kernel Approach

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

Contact Info

Product

Resources

About