BLINC: multilevel traffic classification in the dark
Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Behavioural Characterization for Network Anomaly Detection
Transactions on Computational Science IV
Hi-index | 0.00 |
A novel approach for fast traffic classification in the high speed networks is proposed, which bases on the protocol behavior statistical features. The frame lengths, arrival times and direction of packets are collected from the real data flows. Comparing the features of the unknown flow with the protocol masks, we can judge which application protocol this flow belongs to. Distinct from other statistic methods, we use the "universal flow-based inter-arrival time" to overcome the influence of RTT variance so that a set of excellent protocol masks is site-independent and time-independent. Because there is no need for character string searching and complex algorithms, the proposed approach can be easily deployed in the hardware of high speed network equipments.