Inferring applications at the network layer using collective traffic statistics

Authors:
Yu Jin;Nick Duffield;Patrick Haffner;Subhabrata Sen;Zhi-Li Zhang
Affiliations:
University of Minnesota, Minneapolis, MN, USA;AT&T Research, Florham Park, NJ, USA;AT&T Research, Florham Park, NJ, USA;AT&T Research, Florham Park, NJ, USA;University of Minnesota, Minneapolis, MN, USA
Venue:
Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Year:
2010

Citing 3
Cited 2

Internet traffic classification using bayesian analysis techniques

SIGMETRICS '05 Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Unveiling core network-wide communication patterns through application traffic activity graph decomposition

Proceedings of the eleventh international joint conference on Measurement and modeling of computer systems

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

ACM Transactions on Knowledge Discovery from Data (TKDD)
Reviewing traffic classification

DataTraffic Monitoring and Analysis

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we propose a novel technique for inferring the distribution of application classes present in the aggregated traffic flows between endpoints, which exploits both the statistics of the traffic flows, and the spatial distribution of those flows across the network. Our method employs a two-step supervised model, where the bootstrapping step provides initial (inaccurate) inference on the traffic application classes, and the graph-based calibration step adjusts the initial inference through the collective spatial traffic distribution. In evaluations using real traffic flow measurements from a large ISP, we show how our method can accurately classify application types within aggregate traffic between endpoints, even without the knowledge of ports and other traffic features. While the bootstrap estimate classifies the aggregates with 80% accuracy, incorporating spatial distributions through calibration increases the accuracy to 92%, i.e., roughly halving the number of errors.