Quantifying the accuracy of the ground truth associated with Internet traffic traces

摘要

Ground truth information tor internet traffic traces is often derived by means of port anal?ysis and payload inspection (Deep Packet Inspection - DPI). In this paper we analyze the errors that DPI and port analysis commit when assigning protocol labels to traffic traces. We compare the ground truth provided by these approaches with that derived by gt, a tool that we developed, which provides error-free ground truth at the application level by con?struction. Experimental results demonstrate that, depending on the protocols composing a trace, ground truth information from port analysis and DPI can be incorrect for up to 91% and 26% of the labeled bytes, respectively.