Scipediacontent: Scipediacontent moved page Draft Content 967262824 to Salamatian et al 2006a

2021-02-03T20:25:08Z

Scipediacontent moved page Draft Content 967262824 to Salamatian et al 2006a

Scipediacontent: Created page with " == Abstract == International audience; The automatic detection of applications associated with net-work traffic is an essential step for network security and traffic enginee..."

2021-02-03T20:25:05Z

Created page with " == Abstract == International audience; The automatic detection of applications associated with net-work traffic is an essential step for network security and traffic enginee..."

New page

== Abstract ==

International audience; The automatic detection of applications associated with net-work traffic is an essential step for network security and traffic engineering. Unfortunately, simple port-based clas-sification methods are not always efficient and systematic analysis of packet payloads is too slow. Most recent re-search proposals use flow statistics to classify traffic flows once they are finished, which limit their applicability for on-line classification. In this paper, we evaluate the feasibility of application identification at the beginning of a TCP con-nection. Based on an analysis of packet traces collected on eight different networks, we find that it is possible to distin-guish the behavior of an application from the observation of the size and the direction of the first few packets of the TCP connection. We apply three techniques to cluster TCP connections: K-Means, Gaussian Mixture Model and spec-tral clustering. Resulting clusters are used together with assignment and labeling heuristics to design classifiers. We evaluate these classifiers on different packet traces. Our re-sults show that the first four packets of a TCP connection are sufficient to classify known applications with an accu-racy over 90% and to identify new applications as unknown with a probability of 60%.

== Original document ==

The different versions of the original document can be found in:

* [http://dx.doi.org/10.1145/1368436.1368445 http://dx.doi.org/10.1145/1368436.1368445]

* [https://hal.inria.fr/hal-01097554/file/bernaille-conext06.pdf https://hal.inria.fr/hal-01097554/file/bernaille-conext06.pdf]

* [https://hal.inria.fr/hal-01097554 https://hal.inria.fr/hal-01097554],
: [https://hal.inria.fr/hal-01097554/document https://hal.inria.fr/hal-01097554/document],
: [https://hal.inria.fr/hal-01097554/file/bernaille-conext06.pdf https://hal.inria.fr/hal-01097554/file/bernaille-conext06.pdf]

* [https://hal.inria.fr/hal-01097554/document https://hal.inria.fr/hal-01097554/document],
: [https://who.rocq.inria.fr/Renata.Teixeira/bernaille-conext06.pdf https://who.rocq.inria.fr/Renata.Teixeira/bernaille-conext06.pdf],
: [http://conferences.sigcomm.org/co-next/2006/Conext06_Proceedings/papers/f17.pdf http://conferences.sigcomm.org/co-next/2006/Conext06_Proceedings/papers/f17.pdf],
: [https://eprints.lancs.ac.uk/id/eprint/2603 https://eprints.lancs.ac.uk/id/eprint/2603],
: [https://dl.acm.org/citation.cfm?id=1368445 https://dl.acm.org/citation.cfm?id=1368445],
: [https://hal.inria.fr/hal-01097554 https://hal.inria.fr/hal-01097554],
: [https://dblp.uni-trier.de/db/conf/conext/conext2006.html#BernailleTS06 https://dblp.uni-trier.de/db/conf/conext/conext2006.html#BernailleTS06],
: [https://doi.acm.org/10.1145/1368436.1368445 https://doi.acm.org/10.1145/1368436.1368445],
: [https://doi.org/10.1145/1368436.1368445 https://doi.org/10.1145/1368436.1368445],
: [https://hal.archives-ouvertes.fr/hal-01097554 https://hal.archives-ouvertes.fr/hal-01097554],
: [https://academic.microsoft.com/#/detail/2055261595 https://academic.microsoft.com/#/detail/2055261595]

* [http://dl.acm.org/ft_gateway.cfm?id=1368445&ftid=517689&dwn=1 http://dl.acm.org/ft_gateway.cfm?id=1368445&ftid=517689&dwn=1],
: [http://dx.doi.org/10.1145/1368436.1368445 http://dx.doi.org/10.1145/1368436.1368445]

← Older revision	Revision as of 20:25, 3 February 2021
(No difference)

Salamatian et al 2006a - Revision history

Scipediacontent: Scipediacontent moved page Draft Content 967262824 to Salamatian et al 2006a

Scipediacontent: Created page with " == Abstract == International audience; The automatic detection of applications associated with net-work traffic is an essential step for network security and traffic enginee..."