Towards automated application signature generation for traffic identification

Park, Byungchul; Won, Young J.; Kim, Myung-Sup; Hong, James Won‐Ki

doi:10.1109/noms.2008.4575130

Cited by 108 publications

(63 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Park et al [16] investigated the first 100 packets in each flow for four different applications. They discovered that the first few packets are used to send a signal before transmitting the content data, and most of the application signatures are located within the first few packets in a flow.…”

Section: Baseline Classification Systemmentioning

confidence: 99%

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

Self Cite

View full text Add to dashboard Cite

SUMMARYInternet traffic classification is an essential step for stable service provision. The payload signature classifier is considered a reliable method for Internet traffic classification but is prohibitively computationally expensive for real-time handling of large amounts of traffic on high-speed networks. In this paper, we describe several design techniques to minimize the search space of traffic classification and improve the processing speed of the payload signature classifier. Our suggestions are (1) selective matching algorithms based on signature type, (2) signature reorganization using hierarchical structure and traffic locality, and (3) early packet sampling in flow. Each can be applied individually, or in any combination in sequence. The feasibility of our selections is proved via experimental evaluation on traffic traces of our campus and a commercial ISP. We observe 2 to 5 times improvement in processing speed against the untuned classification system and Snort Engine, while maintaining the same level of accuracy.

show abstract

Section: Baseline Classification Systemmentioning

confidence: 99%

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Similarly, HMM implementation [16] covers the comparative analysis of different HMMs with other techniques of traffic classification. The researchers also applied other statistical methods [17], [18] to address the problem of traffic classification in IP networks.…”

Section: Related Workmentioning

confidence: 99%

Lightweight Internet Traffic Classification based on Packet Level Hidden Markov Models

Akhtar¹,

Kamran²

2017

ijacsa

View full text Add to dashboard Cite

Abstract-During the last decade, Internet traffic classification finds its importance not only to safeguard the integrity and security of network resources, but also to ensure the quality of service for business critical applications by optimizing existing network resources. But optimization at first place requires correct identification of different traffic flows. In this paper, we have suggested a framework based on Hidden Markov Model, which will use Internet Packet intrinsic statistical characteristics for traffic classification. The packet inspection based on statistical analysis of its different characteristics has helped to reduce overall computational complexity. Generally, the major challenges associated with any internet traffic classifier are: 1) the limitation to accurately identify encrypted traffic when classification is performed using traditional port based techniques; 2) overall computational complexity, and 3 ) to achieve high accuracy in traffic identification. Our methodology takes advantage of internet packet statistical characteristics in terms of its size and their inter arrival time in order to model different traffic flows. For experimental results, the data set of mostly used internet applications was used. The proposed HMM models best fit the observed traffic with high accuracy. Achieved traffic identification accuracy was 91% for packet size classifier whereas it was 82% for inter packet time based classifier.

show abstract

“…Longest Application Signature ExtRaction (LASER) algorithm exists for automatic signature generation of patterns using packet payload. But the disadvantage is that common sequences can also exist in many genuine packets which may lead to buffering of genuine packets resulting in increased overhead [8]. Honeycomb, which generates automatic signatures from packet payload uses Longest Common Substring (LCS) algorithm.…”

Section: Introductionmentioning

confidence: 99%

Auto-Pattern Programmable Kernel Filter (Auto-PPKF) for Suppression of Bot Generated Traffic

Govind¹,

Selvakumar²

2013

IJCNIS

View full text Add to dashboard Cite

Abstract-Bots usually vary from their other malicious counter parts by periodically reporting to the botmaster through regular exchange of messages. Our experiments on bot attack generation showed a continuous exchange of packets with similar content between the botmaster and the zombie machine at various time intervals. Though there were also genuine packets with similar content being sent out of the victim machine challenge was to differentiate between the two and pass only the genuine ones.

show abstract

Towards automated application signature generation for traffic identification

Cited by 108 publications

References 9 publications

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Lightweight Internet Traffic Classification based on Packet Level Hidden Markov Models

Auto-Pattern Programmable Kernel Filter (Auto-PPKF) for Suppression of Bot Generated Traffic

Contact Info

Product

Resources

About