RDClass: on using relative distance of keywords for accurate network traffic classification. Issue 4 (1st July 2018)

• Record Type: Journal Article
• Authors: Swarnkar, Mayank; Hubballi, Neminath
• Is Part Of: IET networks. Volume 7:Issue 4(2018)
• Page Start: 273
• Page End: 279
• Publication Date: 2018-07-01
• Subjects: computer network management; relative distance -- network traffic classification -- network management -- security monitoring -- deep‐packet‐inspection -- RDClass -- content‐based traffic classifier -- state transition machine -- relative distance constrained counting automata -- RDCCA -- unknown application payloads -- keyword ordering; Computer network architectures -- Periodicals; Computer network protocols -- Periodicals; Information networks -- Periodicals; Telecommunication systems -- Periodicals; 004.605
• DOI: 10.1049/iet-net.2017.0065
• Languages: English
• ISSNs: 2047-4954

Abstract

Abstract : Network traffic classification has many applications including network management and security monitoring. Deep‐packet‐inspection is a commonly used method for identifying applications. However, the methods found in the literature only use these keywords or bytes in payload disregarding their position. The authors propose RDClass a content‐based traffic classifier for accurately classifying network flows. RDClass uses a set of keywords extracted from the payload and the relative distance between keywords to identify applications. The idea of using the relative distance between keywords is motivated by the fact that for many applications the set of keywords appear within specific portions of payload. These sets of keywords and their relative distances are encoded in the form of a state transition machine. The authors design a new state transition machine called relative distance constrained counting automata ( RDCCA ) which can check both ordering of keywords and their relative distance within the payload to classify flows. RDClass can automatically generate a set of keywords and find their relative ordering to generate RDCCA when presented with unknown application payloads. The authors experiment with a range of applications and show that RDClass has better classification performance than previous methods which use only ordering of keywords.