Strategies for automatic labelling of web traffic traces

In the field of traffic classification, previous efforts have been centered on identifying applications (HTTP, SMTP, FTP, etc) rather than the actual services that they provide (email, file transfer, video streaming, etc.). Nowadays, however, a single application as HTTP can provide multiple services for the end-user. Some methods have been proposed to distinguish between these services but tuning and testing them remains a challenge as there is no easy way to obtain labelled HTTP traffic traces. In this paper we present a method to discover server IP addresses related to a specific website in a traffic trace. Our method uses NetFlow-type records which makes it scalable an impervious to encryption of packet payloads. By applying the method to a representative set of websites the resulting list of IP addresses can be used to label a sizeable number of connections in the trace.