Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > publications : bib : networking : entries : Dainotti08Classification.xml
Bibliography Details
A. Dainotti, W. de Donato, A. Pescape, and P. Salvo~Rossi, "Classification of Network Traffic via Packet-Level Hidden Markov Models", in IEEE GLOBECOM, 2008.
Classification of Network Traffic via Packet-Level Hidden Markov Models
Authors: A. Dainotti
W. de Donato
A. Pescape
P. Salvo Rossi
Published: IEEE GLOBECOM, 2008
URL:http://wpage.unina.it/alberto/papers/globecom_hmmclass_05-11-03.pdf
ABSTRACT: Traffic classification and identification is a fertile research area. Beyond Quality of Service, service differentiation, and billing, one of the most important applications of traffic classification is in the field of network security. This paper proposes a packet-level traffic classification approach based on Hidden Markov Model (HMM). Classification is performed by using real network traffic and estimating - in a combined fashion - Packet Size (PS) and Inter Packet Time (IPT) characteristics, thus remaining applicable to encrypted traffic too. The effectiveness of the proposed approach is evaluated by considering several traffic typologies: we applied our model to real traffic traces of Age of Mythology and Counter Strike (two Multi Player Network Games), HTTP, SMTP, Edonkey, PPlive (a peer-to-peer IPTV application), and MSN Messenger. An analytical basis and the mathematical details regarding the model are given. Results show how the proposed approach is able to classify network traffic by using packet-level statistical properties and therefore it is a good candidate as a component for a multi-classification framework.
RESULTS:
  • propose a packet-level traffic classification approach based on Hidden Markov Model
  • be preformed by Packet Size and Inter Packet Time characteristics
  • apply to several real traffic traces: Network games, HTTP,SMTP, EDonkey, PPLive, MSN
  • traces are verified through deep payload inspection and manual checks
  • for all the applications, a correct classification percentage above 90% is achieved
  Last Modified: Wed Mar-27-2019 22:23:19 PDT
  Page URL: http://www.caida.org/publications/bib/networking/entries/Dainotti08Classification.xml