URL: http://publications.lib.chalmers.se/cpl/record/index.xsql?pubid=67860 Entry Dates: 2009-02-11 Abstract: In this paper Internet backbone traffic is classified on transport layer according to network applications. Classification is done by a set of heuristics inspired by two previous articles and refined in order to better reflect a rough and highly aggregated backbone environment. Obvious misclassified flows by the existing two approaches are revealed and updated heuristics are presented, excluding the revealed false positives, but including missed P2P streams. The proposed set of heuristics is intended to provide researchers and network operators with a relatively simple and fast method to get insight into the type of data carried by their links. A complete application classification can be provided even for short 'snapshot' traces, including identification of attack and malicious traffic. The usefulness of the heuristics is finally shown on a large dataset of backbone traffic, where in the best case only 0.2% of the data is left unclassified. Results:

• datasets: collected during 20 days in April 2006 on the OC192 backbone of the Swedish University Network (SUNET); 0.33*4 h each day for 20 days
• propose a set of heuristics for classifying backbone-type data according to applications;