標題: Session level flow classification by packet size distribution and session grouping
作者: Lu, Chun-Nan
Huang, Chun-Ying
Lin, Ying-Dar
Lai, Yuan-Cheng
資訊工程學系
Department of Computer Science
關鍵字: Flow classification;Session grouping;Session classification;Packet size distribution
公開日期: 12-一月-2012
摘要: Classifying traffic into specific network applications is essential for application-aware network management and it becomes more challenging because modern applications complicate their network behaviors. While port number-based classifiers work only for some well-known applications and signature-based classifiers are not applicable to encrypted packet payloads, researchers tend to classify network traffic based on behaviors observed in network applications. In this paper, a session level flow classification (SLFC) approach is proposed to classify network flows as a session, which comprises of flows in the same conversation. SLFC first classifies flows into the corresponding applications by packet size distribution (PSD) and then groups flows as sessions by port locality. With PSD, each flow is transformed into a set of points in a two-dimension space and the distances between each flow and the representatives of pre-selected applications are computed. The flow is recognized as the application having a minimum distance. Meanwhile, port locality is used to group flows as sessions because an application often uses consecutive port numbers within a session. If flows of a session are classified into different applications, an arbitration algorithm is invoked to make the correction. The evaluation shows that SLFC achieves high accuracy rates on both flow and session classifications, say 99.9% and 99.98%, respectively. When SLFC is applied to online classification, it is able to make decisions quickly by checking at most 300 packets for long-lasting flows. Based on our test data, an average of 72% of packets in long-lasting flows can be skipped without reducing the classification accuracy rates. (C) 2011 Elsevier B.V. All rights reserved.
URI: http://dx.doi.org/10.1016/j.comnet.2011.09.007
http://hdl.handle.net/11536/15682
ISSN: 1389-1286
DOI: 10.1016/j.comnet.2011.09.007
期刊: COMPUTER NETWORKS
Volume: 56
Issue: 1
起始頁: 260
結束頁: 272
顯示於類別:期刊論文


文件中的檔案:

  1. 000299855200019.pdf