URL: http://dpnm.postech.ac.kr/papers/NOMS/08/signature.pdf Entry Dates: 2009-02-11 Abstract: Traditionally, Internet applications have been identified by using predefined well-known ports with questionable accuracy. An alternative approach, applicationlayer signature mapping, involves the exhaustive search of reliable signatures but with more promising accuracy. With a prior protocol knowledge, the signature generation can guarantee a high accuracy. As more applications use proprietary protocols, it becomes increasingly difficult to obtain an accurate signature while avoiding time-consuming and manual signature generation process. This paper proposes an automated approach for generating application-level signature, the LASER algorithm, that does not need to be preceded by an analysis of application protocols. We show that our approach is as accurate and efficient as the approach that uses preceding application protocol analysis. Results:

• datasets: full packet trace collected from the POSTECH campus network, 3 hour period on August 16,2007 and total traffic volume was about 450 Gbytes;
• propose a LCS-based (Longest common subsequence) Application Signature ExtRaction algorithm (LASER), which can automatically determine a trustworthy pattern in the packet's payload without a prior knowledge of protocl formats;