Support Vector Machine Detection of Peer-to-Peer Traffic

In this paper, we introduce a hierarchical internet application traffic classification system based on SVM as an alternative overcoming the uppermost limit of the conventional methodology which is using the port number or payload information. After selecting an optimal attribute subset of the bidirectional traffic flow data collected from the campus, the proposed system classifies the internet application traffic hierarchically. The system is composed of three layers: the first layer quickly determines P2P traffic and non-P2P traffic using a SVM, the second layer classifies P2P traffics into file-sharing, messenger, and TV, based on three SVDDs. The third layer makes specific classification of the entire 16 application traffics. By classifying the internet application traffic finely or coarsely, the proposed system can guarantee an efficient system resource management, a stable network environment, a seamless bandwidth, and an appropriate QoS. Also, even a new application traffic is added, it is possible to have a system incremental updating and scalability by training only a new SVDD without retraining the whole system. We validate the performance of our approach with computer experiments.

show abstract

Section: 서 론unclassified

Hierarchical Internet Application Traffic Classification using a Multi-class SVM

유재학¹,

이한성²,

임영희³

et al. 2010

Journal of Korean Institute of Intelligent Systems

View full text Add to dashboard Cite

show abstract

“…The behavioural method based on entropy reported in [11] requires the evaluation of the entropy of the packet sizes in a given time window and works on-the-fly. Several approaches requiring the analysis of some fields of the header of TCP or IP packets for flowbased P2P traffic detection have been proposed based on machine learning [10] [12], support vector machines [13] [14], and neural networks [15]. This kind of methods may be used for high-speed and real-time communications with encrypted traffic or unknown P2P protocols.…”

Section: Introductionmentioning

confidence: 99%

Detection of Encrypted Traffic in eDonkey Network through Application Signatures

Freire

Carvalho

Pereira

2009

2009 First International Conference on Advances in P2P Systems

View full text Add to dashboard Cite

Peer-to-peer file sharing applications became very popular, being responsible for a large percentage of the network traffic. However, peer-to-peer traffic may compromise the performance of enterprise critical networked applications or network-based tasks or may overload the network infrastructure of Internet Service Providers, being desirable that this traffic be blocked in some situations. However, this task may be difficult to achieve, namely for networks operating at very high-speed bit rates and low latency and/or when the traffic is encrypted. This paper addresses the problem of detecting and blocking encrypted traffic generated by eMule, which is one of the most difficult to detect among popular peer-to-peer file sharing applications. The proposed method is based on eMule signatures, which are coded as SNORT rules, this system being used to detect and block eMule traffic. Experiments have been carried out to evaluate the proposed method. The contribution of the paper falls within peer-to-peer security or within legal and regulatory issues.Keywords -peer-to-peer file sharing applications; eDonkey Network; traffic identification and classification; deep packet inspection; peer-to-peer security; legal and regulatory issues.

show abstract

“…Nowadays, machine learning methods of traffic classification mainly include: SVM [8], naï ve Bayes [9], K-NN [10], K-means [11], C4.5 decision tree [12] etc. Support Vector Machine (SVM) is known to be one of the best machine learning algorithms to classify abnormal behaviors.…”

Section: Introductionmentioning

confidence: 99%

Network Traffic Classification Using Feature Selection and Parameter Optimization

Cao¹,

Fang²,

Zhang³

et al. 2015

jcm

View full text Add to dashboard Cite

Network traffic classification is the foundation of many network research works. In recent years, the research on traffic classification and identification based on machine learning method is a new research direction. Support Vector Machine (SVM) is the one of the machine learning method which performs good accuracy and stability. However, the traditional classification performance of SVM is not ideal. We proposed an optimized method which can improve the performance of SVM greatly. we extracted feature subset with wrapper approach and calculated the optimal working parameters automatically based on grid search algorithm. We applied this method to two-class SVM classifier. The simulation results validated that all of the flows' average accuracy reaches 99.64%, average feature dimension reduces 20% than original dimension and average elapsed time is shorter 98.88% than traditional SVM. The optimized method can reduce feature dimension, shorten elapsed time, improve the performance of SVM classifier obviously.

show abstract

Support Vector Machine Detection of Peer-to-Peer Traffic

Cited by 5 publications

References 9 publications

Hierarchical Internet Application Traffic Classification using a Multi-class SVM

Hierarchical Internet Application Traffic Classification using a Multi-class SVM

Detection of Encrypted Traffic in eDonkey Network through Application Signatures

Network Traffic Classification Using Feature Selection and Parameter Optimization

Contact Info

Product

Resources

About