Real-time traffic classification based on statistical tests for matching signatures with packet length distributions

Classifying network traffic constitutes one of the most defying research topics nowadays. On the one hand, traffic classification is critical for assuring Quality of Service (QoS), the correct functioning and the security of the networks. On the other hand, the increasing complexity and throughput of networks, added to the problems caused by encryption and other evasive techniques, make of traffic classification a difficult and expensive task to perform. This paper describes a traffic classification in the dark mechanism based on matching several empirical distributions representing computer applications with the one of the target traffic. The classifier combines two methods for performing such matching in real-time and on a packet-by-packet manner: one based on the Kolmogorov-Smirnov test, and another one based on the Chi-Squared test. The experimental results included show that the mechanism is accurate and suitable for implementations demanding real-time operation.