Towards passive DNS software fingerprinting
Proceedings of the 9th Asian Internet Engineering Conference
| Hi-index | 0.00 |
Traffic classification using statistical characteristics (or fingerprints) of IP flows such as packet size and packet inter-arrival time has showed its preliminary success in sense of accuracy and simplicity. However, the need of large memory to store the fingerprints makes it impractical to deploy such method on backbone networks where a high-speed memory is needed to catch up with the high packet rate, and a large high-speed memory is always expensive. In this paper we apply the Distributional Clustering (DC) algorithm proposed by the pattern recognition community to compress the protocol fingerprints. We also presented a new algorithm named Distributional Quantification (DQ) that has lower overhead than DC. We evaluated the accuracy of classification using compact protocol fingerprints under various compression ratios through experiments. Our results show that DC outperforms DQ in terms of classification accuracy. The experimental results indicate that a compression ratio of 9 can be achieved with no more than 10% loss in classification accuracy.