A novel approach for fast traffic classification for the high speed networks is proposed, which bases on the protocol behavior statistical features. The packet size and a new parameter named “Estimated Protocol Processing Time” are collected from the real data flows. Then a set of joint probability distributions is obtained to describe the protocol behaviors and classify the traffic. Comparing the parameters of an unknown flow with the pre-obtained joint distributions, we can judge which application protocol the unknown flow belongs to. Distinct from other methods based on traditional inter-arrival time, we use the “Estimated Protocol Processing Time” to reduce the location dependence and time dependence and obtain better results than traditional traffic classification method. Since there is no need for character string searching and parallel feature for hardware implementation with pipeline-mode data processing, the proposed approach can be easily deployed in the hardware for real-time classification in the high speed networks.
展开▼
