Q126 : Extraction of Statistical Features from Network Traffic to Identify Applications on Routers
Thesis > Central Library of Shahrood University > Computer Engineering > PhD > 2018
Authors:
Mohammad Reza Gandomi [Author], Prof. Hamid Hassanpour[Supervisor], Nematolah Shiri [Advisor]
Abstarct: There are huge petitions of network traffic coming from various applications in internet. In dealing with this volume of network traffic, network management plays a crucial rule. Traffic classification is a basic technique which is used by internet service providers to manage network resources and guarantee internet security. In addition, growing bandwidth usage, at one hand, and limited physical capacity of communication lines, at the other hand, lead providers to improve utilization quality of network resources. In fact, classification or identification of network is a critical task in network processing for traffic management, anomaly detection and also to improve network quality-of-service (QoS). Port and payload baxsed methods are two classical techniques which are applicable under traditional network conditions. However, many internet applications use dynamic port numbers for communications, which leads to difficulties in identifying traffic using port numbers. Also many applications encrypt the data before transmitting to avoid detection. Therefore, payloadbaxsed techniques become ineffective for these traffics. In recent years, statistical feature-baxsed traffic flow identification methods (STFIM) have attracted the attention of many researchers. The most important part of a STFIM is selection of efficient statistical features. Preliminary analysis shows that the changes of behaviors in different versions of an application and problem of packet loss in data transmission are the major challenges in employing STFIM for network traffic identification. This affects the statistical characteristics of packets, such as the time interval between sending successive application packets, and in some cases significantly reduces the accuracy of traffic identification. The main objective of this paper is to examine the effects of packet loss on statistical features, and therefore the accuracy of identifying applications, as well as extracting appropriate features to overcome these effects. For this purpose, the behavior of four statistical features, including the packet size, the time interval between send and receive packets, the duration of the flows and the rate of sending packets, are investigated and by extracting the characteristics of their distribution, network traffic is identified. For this reason, a traffic databaxse of seven applications with different packet loss rates has been analyzed and the accuracy of the identification of applications by the neural network has been analyzed. The results show that the extracted features are robust against the loss of packets and that it closely approaches the detection of network traffic in different modes of loss events depending on the ideal state (no loss of packet loss in the network).
Keywords:
#Network Traffic #Network traffic Identification #Machine Learning #Packet Loss #Behavioral Analysis #Data Mining Link
Keeping place: Central Library of Shahrood University
Visitor: