Using host profiling to refine statistical application identification

Mohamad Jaber 1 Roberto Cascella 1 Chadi Barakat 1
1 PLANETE - Protocols and applications for the Internet
Inria Grenoble - Rhône-Alpes, CRISAM - Inria Sophia Antipolis - Méditerranée
Abstract : The identification of Internet traffic applications is very important for ISPs and network administrators to protect their resources from unwanted traffic and prioritize some major applications. Statistical methods are preferred to port-based ones and deep packet inspection since they don't rely on the port number, which can change dynamically, and they also work for encrypted traffic. These methods combine the statistical analysis of the application packet flow parameters, such as packet size and inter-packet time, with machine learning techniques. Other successful approaches rely on the way the hosts communicate and their traffic patterns to identify applications. In this paper, we propose a new online method for traffic classification that combines the statistical and host-based approaches in order to construct a robust and precise method for early Internet traffic identification. We use the packet size as the main feature for the classification and we benefit from the traffic profile of the host (i.e. which application and how much) to refine the classification and decide in favor of this or that application. The host profile is then updated online based on the result of the classification of previous flows originated by or addressed to the same host. We evaluate our method on real traces using several applications. The results show that leveraging the traffic pattern of the host ameliorates the performance of statistical methods. They also prove the capacity of our solution to derive profiles for the traffic of Internet hosts and to identify the services they provide.
Type de document :
Communication dans un congrès
IEEE INFOCOM Mini-Conference, Mar 2012, Orlando, United States. pp.9, 2012, 〈10.1109/INFCOM.2012.6195692〉
Liste complète des métadonnées

Littérature citée [15 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/inria-00577223
Contributeur : Chadi Barakat <>
Soumis le : jeudi 12 janvier 2012 - 15:57:22
Dernière modification le : jeudi 11 janvier 2018 - 16:44:53
Document(s) archivé(s) le : mardi 13 décembre 2016 - 19:01:16

Fichier

Jaber-Profiling.pdf
Fichiers produits par l'(les) auteur(s)

Licence


Copyright (Tous droits réservés)

Identifiants

Collections

Citation

Mohamad Jaber, Roberto Cascella, Chadi Barakat. Using host profiling to refine statistical application identification. IEEE INFOCOM Mini-Conference, Mar 2012, Orlando, United States. pp.9, 2012, 〈10.1109/INFCOM.2012.6195692〉. 〈inria-00577223〉

Partager

Métriques

Consultations de la notice

305

Téléchargements de fichiers

243