Title :
Automatically mining application signatures for lightweight deep packet inspection
Author :
Lu Gang ; Zhang Hongli ; Zhang Yu ; Qassrawi, M.T. ; Yu Xiangzhan ; Peng Lizhi
Author_Institution :
Sch. of Comput. Sci. & Technol., Harbin Inst. of Technol., Harbin, China
Abstract :
Automatic signature generation approaches have been widely applied in recent traffic classification. However, they are not suitable for LightWeight Deep Packet Inspection (LW_DPI) since their generated signatures are matched through a search of the entire application data. On the basis of LW_DPI schemes, we present two Hierarchical Clustering (HC) algorithms: HC_TCP and HC_UDP, which can generate byte signatures from TCP and UDP packet payloads respectively. In particular, HC_TCP and HC_ UDP can extract the positions of byte signatures in packet payloads. Further, in order to deal with the case in which byte signatures cannot be derived, we develop an algorithm for generating bit signatures. Compared with the LASER algorithm and Suffix Tree (ST)-based algorithm, the proposed algorithms are better in terms of both classification accuracy and speed. Moreover, the experimental results indicate that, as long as the application-protocol header exists, it is possible to automatically derive reliable and accurate signatures combined with their positions in packet payloads.
Keywords :
Internet; data mining; inspection; telecommunication traffic; transport protocols; HC_TCP; HC_UDP; LASER algorithm; LW_DPI; application protocol header; application signatures; automatic signature generation; byte signatures; classification accuracy; hierarchical clustering; lightweight deep packet inspection; packet payloads; traffic classification; Classification algorithms; Clustering algorithms; Machine learning algorithms; Payloads; Ports (Computers); Telecommunication traffic; Training; LW_DPI; association mining; automatic signature generation; hierarchical clustering; traffic classification;
Journal_Title :
Communications, China
DOI :
10.1109/CC.2013.6549262