Identifying application level protocols by analyzing communication patterns over multiple ports.

摘要

Discovering the specific applications running on a computer network is of utmost importance for quality of service and other resource management, network planning, network security, and usage policy enforcement. Unfortunately, the evolution of application protocols has rendered traditional network application methods such as transport layer port-based identification and deep packet inspection nearly useless as applications tend to use non-standard ports and traffic is increasingly encrypted.;Recently developed connection-based application discovery techniques can identify network applications using only high-level communication information. For example, motif-based techniques classify network applications by identifying communication sub-graphs (motifs). This thesis seeks to improve the accuracy of motif-based approaches by considering graphs built from the multiple services (ports) an application my use. Using the additional information provided by multiple ports, this thesis may be able to improve network application classification accuracy.