Network traffic identification in packet sampling environment

With the rapid growth of network bandwidth,traffic identification is currently an important challenge for network management and security.In recent years,packet sampling has been widely used in most network management systems.In this paper,in order to improve the accuracy of network traffic identification,sampled NetFlow data is applied to traffic identification,and the impact of packet sampling on the accuracy of the identification method is studied.This study includes feature selection,a metric correlation analysis for the application behavior,and a traffic identification algorithm.Theoretical analysis and experimental results show that the significance of behavior characteristics becomes lower in the packet sampling environment.Meanwhile,in this paper,the correlation analysis results in different trends according to different features.However,as long as the flow number meets the statistical requirement,the feature selection and the correlation degree will be independent of the sampling ratio.While in a high sampling ratio,where the effective information would be less,the identification accuracy is much lower than the unsampled packets.Finally,in order to improve the accuracy of the identification,we propose a Deep Belief Networks Application Identification(DBNAI)method,which can achieve better classification performance than other state-of-the-art methods.

P2P Streaming Traffic Classification in High-Speed Networks

The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,and so are the results of different sampling rates.It is proved that the unified classification model with the proposed attributes can identify P2P streaming quickly and efficiently in the online system.Even with 1:50 sampling rate,the recognition accuracy can be higher than 94%.Moreover,we have evaluated the CPU resources,storage capacity and time consumption before and after the sampling,it is shown that the classification model after the sampling can significantly reduce the resource requirements with the same recognition accuracy.

EARLY RECOGNITION OF INTERNET TRAFFIC BASED ON SIGNATURE INSPECTION

The accurate and efficient classification of Internet traffic is the first and key step to ac-curate traffic management,network security and traffic analysis. The classic ways to identify flows is either inaccurate or inefficient,which are not suitable to be applied to real-time online classification. In this paper,we originally presented an early recognition method named Early Recognition Based on Deep Packet Inspection (ERBDPI) based on deep packet inspection,after analyzing the distribution of payload signature between packets of a flow in detail. The basic concept of ERBDPI is classifying flows based on the payload signature of their first some packets,so that we can identify traffic at the be-ginning of a flow connection. We compared the performance of ERBDPI with that of traditional sampling methods both synthetically and using real-world traffic traces. The result shows that ERBDPI can get a higher classification accuracy with a lower packet sampling rate,which makes it suitable to be applied to accurate real-time classification in high-speed links.