中国邮电高校学报(英文) ›› 2009, Vol. 16 ›› Issue (3): 84-88.doi: 10.1016/S1005-8885(08)60231-9

• Networks • 上一篇    下一篇

Identifying online traffic based on property of TCP flow

洪民火,顾仁涛,王宏祥,孙咏梅,纪越峰   

  1. Key Laboratory of Optical Communications and Lightwave Technologies, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2009-06-30
  • 通讯作者: 洪民火

Identifying online traffic based on property of TCP flow

HONG Min-huo, GU Ren-tao, WANG Hong-xiang, SUN Yong-mei, JI Yue-feng   

  1. Key Laboratory of Optical Communications and Lightwave Technologies, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Received:1900-01-01 Revised:1900-01-01 Online:2009-06-30
  • Contact: HONG Min-huo

摘要:

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult when many applications use dynamic port numbers, masquerading techniques, and encryption to avoid detection. In this article, an approach is presented for online traffic classification relying on the observation of the first n packets of a transmission control protocol (TCP) connection. Its key idea is to utilize the properties of the observed first ten packets of a TCP connection and Bayesian network method to build a classifier. This classifier can classify TCP flows dynamically as packets pass through it by deciding whether a TCP flow belongs to a given application. The experimental results show that the proposed approach performs well in online internet traffic classification and that it is superior to naïve Bayesian method.

关键词:

network;traffic;classification,;inter-arrival;time,;TCP;flow,;Bayesian;network

Abstract:

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult when many applications use dynamic port numbers, masquerading techniques, and encryption to avoid detection. In this article, an approach is presented for online traffic classification relying on the observation of the first n packets of a transmission control protocol (TCP) connection. Its key idea is to utilize the properties of the observed first ten packets of a TCP connection and Bayesian network method to build a classifier. This classifier can classify TCP flows dynamically as packets pass through it by deciding whether a TCP flow belongs to a given application. The experimental results show that the proposed approach performs well in online internet traffic classification and that it is superior to naïve Bayesian method.

Key words:

network traffic classification;inter-arrival time;TCP flow;Bayesian network