On-the-fly Statistical Classifica Classification of Internet Traffiction at Application Layer Based on Cluster Analysis

摘要

We address the problem of classifying Internet packet flows according to the applica- applicationlevel protocol that generated them. Unlike d tion deep packet inspection, which reads up to appli- eep applicationlayer payloads and keeps track of packet sequences, we consider classification based oncation statistical features extracted in real time from the packet flow, namely IP packet lengths andinter-arrival times. A statistical classification algorithm is proposed, built upon the powerfuland rich tools of cluster analysis. By exploiting traffic traces taken at the Networking Lab ofour Department and traces from CAIDA, we defined data sets made up of t thousands of flowshousands for up to five different application protocols. With the classic approach of training and test datasets we show that cluster analysis yields very good results in spite of the little information it isbased on, to stick to the real time decision requirement. We aim to show that the investigatedapplications are characterized from a "signature" at the network layer that can be useful torecognize such applications even when the port number is not significant. Numerical results arepresented to highlight the effect of major algorithm parameters. We discuss complexity andpossible exploitation of the statistical classifier.