LAYSEE: Learn-as-you-see traffic classifier

The ability to classify all traffic that traverses a network is a critical aspect of network management. Signature based traffic classifiers are widely used to provide that capability. The state of the art classifiers rely on static, manual, and tedious approach of protocol reverse engineering to obtain signatures. However, the explosion of never-seen-before applications on the internet has resulted in a drastic reduction in the effectiveness of such systems. To overcome these limitations, we have developed a novel system, called Learn-As-You-SEE (LAYSEE), that aims to provide dynamic, automated, and exhaustive application identification. Our system automatically extracts signatures from network traffic by leveraging the benefits of packet content signature inference techniques and sophisticated behavioral-based analysis. These signatures are used for classifying subsequent traffic.