HMM profiles for network traffic classification

  • Authors:
  • Charles Wright;Fabian Monrose;Gerald M. Masson

  • Affiliations:
  • Johns Hopkins University Information Security Institute;Johns Hopkins University Information Security Institute;Johns Hopkins University Information Security Institute

  • Venue:
  • Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
  • Year:
  • 2004

Quantified Score

Hi-index 0.00

Visualization

Abstract

We present techniques for building HMM profiles for network applications using only the packet-level information that remains intact and observable after encryption, namely, packet size and arrival time. Using less information than previously thought possible, we demonstrate classification accuracy close to that of other recent techniques, and show success in classifying a variety of common network applications as observed from real Internet traffic traces.