An experimental evaluation of the computational cost of a DPI traffic classifier

Authors:
Niccolo Cascarano;Alice Este;Francesco Gringoli;Fulvio Risso;Luca Salgarelli
Affiliations:
Dipartimento di Automatica e Informatica, Politecnico di Torino, Italy;Dipartimento di Elettronica per l'Automazione, Università degli Studi di Brescia, Italy;Dipartimento di Elettronica per l'Automazione, Università degli Studi di Brescia, Italy;Dipartimento di Automatica e Informatica, Politecnico di Torino, Italy;Dipartimento di Elettronica per l'Automazione, Università degli Studi di Brescia, Italy
Venue:
GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Year:
2009

Citing 14
Cited 3

BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Estimating the Support of a High-Dimensional Distribution

Neural Computation
Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
Traffic classification using clustering algorithms

Proceedings of the 2006 SIGCOMM workshop on Mining network data
A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

ACM SIGCOMM Computer Communication Review
Traffic classification through simple statistical fingerprinting

ACM SIGCOMM Computer Communication Review
Identifying and discriminating between web and peer-to-peer traffic in the network core

Proceedings of the 16th international conference on World Wide Web
Early application identification

CoNEXT '06 Proceedings of the 2006 ACM CoNEXT conference
Deflating the big bang: fast and scalable deep packet inspection with extended finite automata

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Efficient regular expression evaluation: theory to practice

Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
Internet traffic classification demystified: myths, caveats, and the best practices

CoNEXT '08 Proceedings of the 2008 ACM CoNEXT Conference
Support Vector Machines for TCP traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Toward the accurate identification of network applications

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement
Self-Learning IP traffic classification based on statistical flow characteristics

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement

Improving cost and accuracy of DPI traffic classifiers

Proceedings of the 2010 ACM Symposium on Applied Computing
Optimizing Deep Packet Inspection for High-Speed Traffic Analysis

Journal of Network and Systems Management
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

A common belief in the scientific community is that traffic classifiers based on Deep Packet Inspection (DPI) are far more expensive in terms of computational complexity compared to statistical classifiers. In this paper we counter this notion by defining accurate models for a Deep Packet Inspection classifier and a statistical one based on Support Vector Machines, and by evaluating their actual processing costs through experimental analysis. The results suggest that, contrary to the common belief, a DPI classifier and an SVM-based one can have comparable computational costs. Although much work is left to prove that our results apply in more general cases, this preliminary analysis is a first indication of how DPI classifiers might not be as computationally complex, compared to other approaches, as we previously thought.