Bibliography Details

W. John and S. Tafvelin, "Heuristics to Classify Internet Backbone Traffic based on Connection Patterns", in International Conference on Information Networking (ICOIN), Sept 2008.

Heuristics to Classify Internet Backbone Traffic based on Connection Patterns
Authors:	W. John S. Tafvelin
Published:	International Conference on Information Networking (ICOIN), 2008
URL:	http://publications.lib.chalmers.se/cpl/record/index.xsql?pubid=67860
Entry Dates:	2009-02-11
Abstract:	In this paper Internet backbone traffic is classified on transport layer according to network applications. Classification is done by a set of heuristics inspired by two previous articles and refined in order to better reflect a rough and highly aggregated backbone environment. Obvious misclassified flows by the existing two approaches are revealed and updated heuristics are presented, excluding the revealed false positives, but including missed P2P streams. The proposed set of heuristics is intended to provide researchers and network operators with a relatively simple and fast method to get insight into the type of data carried by their links. A complete application classification can be provided even for short 'snapshot' traces, including identification of attack and malicious traffic. The usefulness of the heuristics is finally shown on a large dataset of backbone traffic, where in the best case only 0.2% of the data is left unclassified.
Results:	datasets: collected during 20 days in April 2006 on the OC192 backbone of the Swedish University Network (SUNET); 0.33*4 h each day for 20 days propose a set of heuristics for classifying backbone-type data according to applications;