High performance traffic classification based on message size sequence and distribution

Chun Nan Lu*, Chun-Ying Huang, Ying-Dar Lin, Yuan Cheng Lai

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

17 Scopus citations

Abstract

Classifying network flows into applications is a fundamental requirement for network administrators. Administrators used to classify network applications by examining transport layer port numbers or application level signatures. However, emerging network applications often send encrypted traffic with randomized port numbers. This makes it challenging to detect and manage network applications. In this paper, we propose two statistics-based solutions, the message size distribution classifier (MSDC) and the message size sequence classifier (MSSC) depending on classification accuracy and real timeliness. The former aims to identify network flows in an accurate manner, while the latter aims to provide a lightweight and real-time solution. The proposed classifiers can be further combined to build a hybrid solution that achieves both good detection accuracy and short response latency. Our numerical results show that the MSDC can make a decision by inspecting less than 300 packets and achieve a high detection accuracy of 99.98%. In contrast, the MSSC classifier can respond by only looking at the very first 15 packets and have a slightly lower accuracy of 94.99%. Our implementations on a commodity personal computer show that running the MSDC, the MSSC, and the hybrid classifier in-line achieves a throughput of 400 Mbps, 800 Mbps, and 723 Mbps, respectively.

Original languageEnglish
Pages (from-to)60-74
Number of pages15
JournalJournal of Network and Computer Applications
Volume76
DOIs
StatePublished - 1 Dec 2016

Keywords

  • Distribution
  • Message size
  • Packet size
  • Sequence
  • Traffic classification

Fingerprint Dive into the research topics of 'High performance traffic classification based on message size sequence and distribution'. Together they form a unique fingerprint.

Cite this