In-the-dark network traffic classification using support vector machines

Authors:
William H. Turkett;Andrew V. Karode;Errin W. Fulp
Affiliations:
Department of Computer Science, Wake Forest University, Winston-Salem, NC;Department of Computer Science, Wake Forest University, Winston-Salem, NC;Department of Computer Science, Wake Forest University, Winston-Salem, NC
Venue:
IAAI'08 Proceedings of the 20th national conference on Innovative applications of artificial intelligence - Volume 3
Year:
2008

Citing 7
Cited 4

Support-Vector Networks

Machine Learning
Making large-scale support vector machine learning practical

Advances in kernel methods
Reducing Multiclass to Binary: A Unifying Approach for Margin Classifiers

ICML '00 Proceedings of the Seventeenth International Conference on Machine Learning
Behavioral Authentication of Server Flows

ACSAC '03 Proceedings of the 19th Annual Computer Security Applications Conference
On Inferring Application Protocol Behaviors in Encrypted Network Traffic

The Journal of Machine Learning Research
Early recognition of encrypted applications

PAM'07 Proceedings of the 8th international conference on Passive and active network measurement
Using gap-insensitive string kernel to detect masquerading

ADMA'05 Proceedings of the First international conference on Advanced Data Mining and Applications

Using network motifs to identify application protocols

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Predicting computer system failures using support vector machines

WASL'08 Proceedings of the First USENIX conference on Analysis of system logs
Using syslog message sequences for predicting disk failures

LISA'10 Proceedings of the 24th international conference on Large installation system administration
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

This work addresses the problem of in-the-dark traffic classification for TCP sessions, an important problem in network management. An innovative use of support vector machines (SVMs) with a spectrum representation of packet flows is demonstrated to provide a highly accurate, fast, and robust method for classifying common application protocols. The use of a linear kernel allows for an analysis of SVM feature weights to gain insight into the underlying protocol mechanisms.