Behavioral Authentication of Server Flows

10 years 1 months ago
Behavioral Authentication of Server Flows
Understanding the nature of the information flowing into and out of a system or network is fundamental to determining if there is adherence to a usage policy. Traditional methods of determining traffic type rely on the port label carried in the packet header. This method can fail, however, in the presence of proxy servers that re-map port numbers or host services that have been compromised to act as backdoors or covert channels. We present an approach to classify server traffic based on decision trees learned during a training phase. The trees are constructed from traffic described using a set of features we designed to capture stream behavior. Because our classification of the traffic type is independent of port label, it provides a more accurate classification in the presence of malicious activity. An empirical evaluation illustrates that models of both aggregate protocol behavior and host-specific protocol behavior obtain classification accuracies ranging from 82-100%.
James P. Early, Carla E. Brodley, Catherine Rosenb
Added 04 Jul 2010
Updated 04 Jul 2010
Type Conference
Year 2003
Authors James P. Early, Carla E. Brodley, Catherine Rosenberg
Comments (0)