DocumentCode :
16749
Title :
Automatically mining application signatures for lightweight deep packet inspection
Author :
Lu Gang ; Zhang Hongli ; Zhang Yu ; Qassrawi, M.T. ; Yu Xiangzhan ; Peng Lizhi
Author_Institution :
Sch. of Comput. Sci. & Technol., Harbin Inst. of Technol., Harbin, China
Volume :
10
Issue :
6
fYear :
2013
fDate :
Jun-13
Firstpage :
86
Lastpage :
99
Abstract :
Automatic signature generation approaches have been widely applied in recent traffic classification. However, they are not suitable for LightWeight Deep Packet Inspection (LW_DPI) since their generated signatures are matched through a search of the entire application data. On the basis of LW_DPI schemes, we present two Hierarchical Clustering (HC) algorithms: HC_TCP and HC_UDP, which can generate byte signatures from TCP and UDP packet payloads respectively. In particular, HC_TCP and HC_ UDP can extract the positions of byte signatures in packet payloads. Further, in order to deal with the case in which byte signatures cannot be derived, we develop an algorithm for generating bit signatures. Compared with the LASER algorithm and Suffix Tree (ST)-based algorithm, the proposed algorithms are better in terms of both classification accuracy and speed. Moreover, the experimental results indicate that, as long as the application-protocol header exists, it is possible to automatically derive reliable and accurate signatures combined with their positions in packet payloads.
Keywords :
Internet; data mining; inspection; telecommunication traffic; transport protocols; HC_TCP; HC_UDP; LASER algorithm; LW_DPI; application protocol header; application signatures; automatic signature generation; byte signatures; classification accuracy; hierarchical clustering; lightweight deep packet inspection; packet payloads; traffic classification; Classification algorithms; Clustering algorithms; Machine learning algorithms; Payloads; Ports (Computers); Telecommunication traffic; Training; LW_DPI; association mining; automatic signature generation; hierarchical clustering; traffic classification;
fLanguage :
English
Journal_Title :
Communications, China
Publisher :
ieee
ISSN :
1673-5447
Type :
jour
DOI :
10.1109/CC.2013.6549262
Filename :
6549262
Link To Document :
بازگشت