Early application identification

9 years 1 months ago
Early application identification
The automatic detection of applications associated with network traffic is an essential step for network security and traffic engineering. Unfortunately, simple port-based classification methods are not always efficient and systematic analysis of packet payloads is too slow. Most recent research proposals use flow statistics to classify traffic flows once they are finished, which limit their applicability for online classification. In this paper, we evaluate the feasibility of application identification at the beginning of a TCP connection. Based on an analysis of packet traces collected on eight different networks, we find that it is possible to distinguish the behavior of an application from the observation of the size and the direction of the first few packets of the TCP connection. We apply three techniques to cluster TCP connections: K-Means, Gaussian Mixture Model and spectral clustering. Resulting clusters are used together with assignment and labeling heuristics to design clas...
Laurent Bernaille, Renata Teixeira, Kavé Sa
Added 20 Aug 2010
Updated 20 Aug 2010
Type Conference
Year 2006
Authors Laurent Bernaille, Renata Teixeira, Kavé Salamatian
Comments (0)