Please use this identifier to cite or link to this item:
|Title: ||Session level flow classification by packet size distribution and session grouping|
|Authors: ||Chun-Nan Lu;Chun-Ying Huang;Ying-Dar Lin;Yuan-Cheng Lai|
|Keywords: ||Flow classification;Session grouping;Session classification;Packet size distribution|
|Issue Date: ||2013-03-15T08:16:41Z
|Publisher: ||Computer Networks|
|Abstract: ||Abstract:Classifying traffic into specific network applications is essential for application-aware network management and it becomes more challenging because modern applications complicate their network behaviors. While port number-based classifiers work only for some well-known applications and signature-based classifiers are not applicable to encrypted packet payloads, researchers tend to classify network traffic based on behaviors observed in network applications. In this paper, a session level flow classification (SLFC) approach is proposed to classify network flows as a session, which comprises of flows in the same conversation. SLFC first classifies flows into the corresponding applications by packet size distribution (PSD) and then groups flows as sessions by port locality. With PSD, each flow is transformed into a set of points in a two-dimension space and the distances between each flow and the representatives of pre-selected applications are computed. The flow is recognized as the application having a minimum distance. Meanwhile, port locality is used to group flows as sessions because an application often uses consecutive port numbers within a session. If flows of a session are classified into different applications, an arbitration algorithm is invoked to make the correction. The evaluation shows that SLFC achieves high accuracy rates on both flow and session classifications, say 99.9% and 99.98%, respectively. When SLFC is applied to online classification, it is able to make decisions quickly by checking at most 300 packets for long-lasting flows. Based on our test data, an average of 72% of packets in long-lasting flows can be skipped without reducing the classification accuracy rates.|
|Relation: ||56(1), pp.260–272|
|Appears in Collections:||[資訊工程學系] 期刊論文|
Files in This Item:
There are no files associated with this item.
All items in NTOUR are protected by copyright, with all rights reserved.