JISE


  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17]


Journal of Information Science and Engineering, Vol. 31 No. 5, pp. 1669-1692


Traffic Identification Based on Applications using Statistical Signature Free from Abnormal TCP Behavior


HYUN-MIN AN1, SU-KANG LEE1, JAE-HYUN HAM1,2 AND MYUNG-SUP KIM1 
1Department of Computer and Information Science 
Korea University 
Sejong, 30019 Korea 
2The 2nd R&D Institute-1 
Agency for Defense Development 
Daejeon, 34188 Korea 
E-mail: {queen26; sukanglee; jhham; tmskim}@korea.ac.kr


    As network traffic becomes more complex and diverse from the existence of new applications and services, application-based traffic classification is becoming important for the effective use of network resources. To remedy the drawbacks of traditional methods, such as port-based or payload-based traffic classification, traffic classification methods based on the statistical information of a flow have recently been proposed. However, abnormal TCP behaviors, such as a packet retransmission or out-of-order packets, cause inconsistencies in the statistical information of a flow. Furthermore, the analysis results cannot be trusted without resolving the abnormal behaviors. In this paper, we analyze the limitations of traffic classification caused by abnormal TCP behavior, and propose a novel application-based traffic classification method using a statistical signature with resolving abnormal TCP behaviors. The proposed method resolves abnormal TCP behaviors and generates unique signatures for each application using the packet order, direction, and payload size of the first N packets in a flow, and uses them to classify the application traffic. The evaluation shows that this method can classify application traffic easily and quickly with high accuracy rates of over 99%. Furthermore, the method can classify traffic generated by applications that use the same application protocol or are encrypted.


Keywords: application-level traffic classification, application identification, statistical signature, signature-based classification, statistics-based classification

  Retrieve PDF document (JISE_201505_10.pdf)