The ability to accurately classify and identify the network traffic associated with different applications is a central issue for many network operation and research topics including Quality of Service enforcement, traffic engineering, security, monitoring and intrusion-detection. However, traditional classification approaches for traffic to higher-level application mapping, such as those based on port or payload analysis, are highly inaccurate for many emerging applications and hence useless in actual networks. This paper presents a recurrence plot-based traffic classification approach based on the analysis of non-stationary "hidden" transition patterns of IP traffic flows. Such nonlinear properties cannot be affected by payload encryption or dynamic port change and hence cannot be easily masqueraded. In performing a quantitative assessment of the above transition patterns, we used recurrence quantification analysis, a nonlinear technique widely used in many fields of science to discover the time correlations and the hidden dynamics of statistical time series. Our model proved to be effective for providing a deterministic interpretation of recurrence patterns derived by complex protocol dynamics in end-to-end traffic flows, and hence for developing qualitative and quantitative observations that can be reliably used in traffic classification. © 2008 Elsevier B.V. All rights reserved.

Original document

The different versions of the original document can be found in:

http://dx.doi.org/10.1016/j.comnet.2008.12.015 under the license https://www.elsevier.com/tdm/userlicense/1.0/
Back to Top

Document information

Published on 01/01/2009

Volume 2009, 2009
DOI: 10.1016/j.comnet.2008.12.015
Licence: Other

Document Score


Views 2
Recommendations 0

Share this document

claim authorship

Are you one of the authors of this document?