Labeling the Network Traffic with Accurate Application Information

Accurate network traffic classification is crucial for network management and has received widespread attention in the last few years. However, there is not a reliable and widely accepted validation technique for verifying these classification approaches. The main reason is that there are not public traffic traces with accurate application information. In order to address the above problem, this paper presents a new technique, which uses the Network Driver Interface Specification (NDIS) Hook and the Socket Hook to label the packets with the corresponding application on the basis of the user host. The socket hook can capture the packets and gain the related information of the captured packet and send the gained information to the memory. The NDIS Hook can capture the packet and change the header information of the IP packet. Then, these marked packets are sent to the Internet and collected at the boundary gateway.