Internet Traffic Classification aims at the identification of the Internet application that generates a given sequence of packets. Shallow Packet Inspection (SPI) is a new family of classification techniques that only use information available in the external header of packets and the statistical characterization of the traffic process. Therefore, these techniques are applicable even to encrypted or obfuscated traffic. The packet arrival process is a particularly interesting features for traffic classification, as it is difficult to significantly modify it. This paper proposes a classification technique based on a classification feature called Index of Variability, which evaluates the traffic source burstiness over various time scales in order to discriminate among different classes of Internet applications. Experimental results show that this classification method operates effectively both on synthetic and real traffic traces. Synthetic traffic traces make it possible to estimate the classification error rate achieved by the classification algorithm. The usage of real traces allows us to compare the performance of the method to the performance obtained with Deep Packet Inspection (DPI) techniques, showing that SPI and DPI yields similar results.

Internet Traffic Classification Using the Index of Variability

ROTTONDI, CRISTINA EMMA MARGHERITA;VERTICALE, GIACOMO
2012

Abstract

Internet Traffic Classification aims at the identification of the Internet application that generates a given sequence of packets. Shallow Packet Inspection (SPI) is a new family of classification techniques that only use information available in the external header of packets and the statistical characterization of the traffic process. Therefore, these techniques are applicable even to encrypted or obfuscated traffic. The packet arrival process is a particularly interesting features for traffic classification, as it is difficult to significantly modify it. This paper proposes a classification technique based on a classification feature called Index of Variability, which evaluates the traffic source burstiness over various time scales in order to discriminate among different classes of Internet applications. Experimental results show that this classification method operates effectively both on synthetic and real traffic traces. Synthetic traffic traces make it possible to estimate the classification error rate achieved by the classification algorithm. The usage of real traces allows us to compare the performance of the method to the performance obtained with Deep Packet Inspection (DPI) techniques, showing that SPI and DPI yields similar results.
File in questo prodotto:
File Dimensione Formato  
2012_latin_america.pdf

Accesso riservato

: Post-Print (DRAFT o Author’s Accepted Manuscript-AAM)
Dimensione 590.62 kB
Formato Adobe PDF
590.62 kB Adobe PDF   Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: http://hdl.handle.net/11311/659334
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 1
  • ???jsp.display-item.citation.isi??? 1
social impact