ACK utilization for traffic classification

Joseph Kampeas, Asaf Cohen, Omer Gurevvitz

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Network traffic classification is an essential feature for network users and administrators. It allows detailed information about the various applications traversing the network, thus enabling traffic shaping, accounting, anomaly detection, etc. In this paper, we suggest a novel fingerprinting technique to automatically classify ongoing TCP and UDP flows according to the various applications which created them, thus allowing classification with high accuracy. Specifically, for TCP flows, we suggest a fingerprint based on zero-length packets, which enables efficiently classifying flows based on a single Content-Addressable Memory (CAM) rule and a limited sample set, yet with very high accuracy. Moreover, our fingerprint is robust to network conditions such as congestion, fragmentation, delay, retransmissions, duplications and losses. For UDP flows, we utilize a similar approach based on the UDP length field. The fingerprinting schemes are evaluated on a variety of real traffic traces. Results show that the schemes attain very high accuracy. In particular, our scheme attains about 97% overall accuracy for a large variety of applications, by sampling small fraction of the trafik'. The UDP scheme attains over 98% accuracy, by sampling all the UDP traffic.

Original languageEnglish
Title of host publication2016 IEEE International Conference on the Science of Electrical Engineering, ICSEE 2016
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781509021529
DOIs
StatePublished - 4 Jan 2017
Event2016 IEEE International Conference on the Science of Electrical Engineering, ICSEE 2016 - Eilat, Israel
Duration: 16 Nov 201618 Nov 2016

Publication series

Name2016 IEEE International Conference on the Science of Electrical Engineering, ICSEE 2016

Conference

Conference2016 IEEE International Conference on the Science of Electrical Engineering, ICSEE 2016
Country/TerritoryIsrael
CityEilat
Period16/11/1618/11/16

ASJC Scopus subject areas

  • Computer Science Applications
  • Hardware and Architecture
  • Artificial Intelligence
  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint

Dive into the research topics of 'ACK utilization for traffic classification'. Together they form a unique fingerprint.

Cite this