Acta Metallurgica Sinica(English letters) ›› 2009, Vol. 16 ›› Issue (3): 84-88.doi: 10.1016/S1005-8885(08)60231-9

• Networks • Previous Articles     Next Articles

Identifying online traffic based on property of TCP flow

HONG Min-huo, GU Ren-tao, WANG Hong-xiang, SUN Yong-mei, JI Yue-feng   

  1. Key Laboratory of Optical Communications and Lightwave Technologies, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Received:1900-01-01 Revised:1900-01-01 Online:2009-06-30
  • Contact: HONG Min-huo

Abstract:

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult when many applications use dynamic port numbers, masquerading techniques, and encryption to avoid detection. In this article, an approach is presented for online traffic classification relying on the observation of the first n packets of a transmission control protocol (TCP) connection. Its key idea is to utilize the properties of the observed first ten packets of a TCP connection and Bayesian network method to build a classifier. This classifier can classify TCP flows dynamically as packets pass through it by deciding whether a TCP flow belongs to a given application. The experimental results show that the proposed approach performs well in online internet traffic classification and that it is superior to naïve Bayesian method.

Key words:

network traffic classification;inter-arrival time;TCP flow;Bayesian network