1 / 11

Traffic Classification through Simple Statistical Fingerprinting

Traffic Classification through Simple Statistical Fingerprinting. M. Crotti, M. Dusi, F. Gringoli, L. Salgarelli ACM SIGCOMM Computer Communication Review, 2007 Networking Journal Club 9th July 2010. Outline. Introduction (Related Work) Protocol Fingerprints Classification Algorithm

darice
Download Presentation

Traffic Classification through Simple Statistical Fingerprinting

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Traffic Classification through Simple Statistical Fingerprinting M. Crotti, M. Dusi, F. Gringoli, L. Salgarelli ACM SIGCOMM Computer Communication Review, 2007 Networking Journal Club 9th July 2010

  2. Outline • Introduction • (Related Work) • Protocol Fingerprints • Classification Algorithm • Experimental Analysis • Discussion • Future work and Conclusions

  3. Introduction • Motivation: Traffic classification: • Allocation, control and management of resources • Intrusion detection • QoS-aware mechanisms • … • Methods: • Port-based • DPI • …

  4. Protocol Fingerprints • TCP flows (HTTP, SMTP, SSH, …) • Unidirectional • Statistical properties of the flows: • Size of packets • Inter-arrival times • Order of arrivals • PDFi : • Probability density function of packet i-th on the plane (size,interarrival) • PDF: vector of L PDFi

  5. Protocol Fingerprints • Anomaly score: “how statistically far” an unknown flow F is from a given protocol PDF • To smooth PDFi use Gaussian filter: Mi • Preliminary anomaly score: • Anomaly score: • Anomaly threshold: upper bound of the anomaly score to be considered of this protocol

  6. Classification algorithm

  7. Classification algorithm • Collect traffic traces (training set) • Pre-classify traces (the accuracy of the tool is critical) • Build protocol fingerprints • Start the classification engine • Periodically, update the fingerprints • Low computational load 

  8. Experimental Analysis • Traffic traces collected in campus: 24 Mbps link • >60% TCP port: 80, 110, 25 • >40GB, 20K flows, of HTTP, POP3, SMTP • Performance parameters: • Hit rate • False positive rate • 4th packet

  9. Sensitivity to parameters

  10. Discussion • Accuracy of training sets • Complexity of the technique • Fclient or Fserver? Where’s the classifier? • On the precision of the measuring devices

  11. Future Work • Application to a larger data set: VoIP, P2P… • Behavior in different networks • How does the classifier respond to imprecise training set? • Complexity of the algorithm: • memory occupation • amenability to HW-assisted implementation • computational costs of the training phase

More Related