Packet signature mining for application identification using an improved Apriori algorithm

Extracting packet signatures automatically and accurately are the foundation of traffic identification for most network monitoring and forensics application. The Apriori algorithm is a common and useful method to fulfill the task. For huge amount Internet traffic, the traditional Apriori algorithm, produce huge candidate itemsets and will occupy large I/O costs in scanning database. An improvement method is proposed in this paper. Based on the pruning to the candidate and the public signature database, it dynamically reduced the number of the scanning itemsets to make the scanning efficient. The experiment proved that the proposed algorithm can also effectively improve the mining rate.