Software architecture for a lightweight payload signature-based traffic classification system

Authors:
Jun-Sang Park;Sung-Ho Yoon;Myung-Sup Kim
Affiliations:
Dept. of Computer and Information Science, Korea University, Korea;Dept. of Computer and Information Science, Korea University, Korea;Dept. of Computer and Information Science, Korea University, Korea
Venue:
TMA'11 Proceedings of the Third international conference on Traffic monitoring and analysis
Year:
2011

Citing 7
Cited 0

Accurate, scalable in-network identification of p2p traffic using application signatures

Proceedings of the 13th international conference on World Wide Web
Fast and memory-efficient regular expression matching for deep packet inspection

Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
DPICO: a high speed deep packet inspection engine using compact finite automata

Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems
Empirical Analysis of Application-Level Traffic Classification Using Supervised Machine Learning

APNOMS '08 Proceedings of the 11th Asia-Pacific Symposium on Network Operations and Management: Challenges for Next Generation Network Operations and Service Management
Descriptional and Computational Complexity of Finite Automata

LATA '09 Proceedings of the 3rd International Conference on Language and Automata Theory and Applications
Regular Expression Matching on Graphics Hardware for Intrusion Detection

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Internet application traffic classification using fixed IP-port

APNOMS'09 Proceedings of the 12th Asia-Pacific network operations and management conference on Management enabling the future internet for changing business and new computing services

Quantified Score

Hi-index	0.00

Visualization

Abstract

Traffic classification is a preliminary and essential step for achieving stable network service provision and efficient network resource management. While a number of classification methods have been introduced in the literature, the payload signature-based classification method shows the highest performance in terms of accuracy, completeness, and practicality. However, the payload signature-based method has a significant drawback in high-speed network environments; the processing speed is much slower than that of other classification methods such as the header-based and statistical methods. In this paper, we describe various design options to improve the processing speed of traffic classification in designing a payload signature-based classification system, and we describe choices we made for designing our traffic classification system. Also, the feasibility of our design choices was proved via experimental evaluation on our campus traffic trace.