URL: http://www.eurecom.fr/~ennajjar/PUB/IMC09_EnNajjary.pdf ABSTRACT: Accurate identification of network traffic according to application type is a key issue for most companies, including ISPs. For example, some companies might want to ban p2p traffic from their network while some ISPs might want to other additional services based on the application. To classify applications on the fly, most companies rely on deep packet inspection (DPI) solutions. While DPI tools can be accurate, they require constant updates of their signatures database. Recently, several statistical traffic classification methods have been proposed. In this paper, we investigate the use of these methods for an ADSL provider managing many Points of Presence (PoPs). We demonstrate that statistical methods can other performance similar to the ones of DPI tools when the classifier is trained for a specific site. It can also complement existing DPI techniques to mine traffic that the DPI solution failed to identify. However, we also demonstrate that, even if a statistical classifier is very accurate on one site, the resulting model cannot be applied directly to other locations. We show that this problem stems from the statistical classifier learning site specific information. RESULTS:

• statistical classification can help revealing the traffic left unknown by the ground truth establishment tools
• statistical classification is flexible enough to allow to group traffic based on application rather than protocol
• some applications that are correctly classified when the classifier is applied on the same site where it was trained, become difficult to identify when applied on another site