Toward the Accurate Identification of Network Applications

By Andrew William Moore, Konstantina (Dina) Papagiannaki. Passive and Active Network Measurement Conference, 2005

885 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/5ed2b79ea349dd3f03f58e33b7234fe229d5c477

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Issues and future directions in traffic classification (2012, background): “Features include common flow properties (e.g., per-flow duration and volume, mean packet size) as well as more detailed properties, such as sizes and interpacket times of the first n packets of a flow, or entropy of byte distribution in packet headers or payload.”
Bayesian Neural Networks for Internet Traffic Classification (2007, methodology): “Illustrating changes in accuracy derived from content-based classification, Moore and Papagiannaki [7] also noted an accuracy no better than 50%–70% for port-based classification using the official Internet Assigned Numbers Authority (IANA)1 list.”
Internet traffic classification using bayesian analysis techniques (2005, background): “This leads to traditional techniques for traffic/flow classification that are often no-more accurate than 50–70% [1, 2, 3].”
Discriminators for use in flow-based classification (2013, background): “A number of data sets are described; each data set consists a number of objects, and each object is described by a group of features (also referred to as discriminators).”
Traffic classification using clustering algorithms (2006, methodology): “To address the aforementioned drawbacks of port-based classification, several payload-based analysis techniques have been proposed [3, 6, 9, 11, 15].”
ACAS: automated construction of application signatures (2005, methodology): “Possible approaches in constructing the training sets include the ones described in[7] as well as monitoring of traffic on a VPN type network in which traffic can be mapped to applications based on server IPs.”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, background): “Furthermore, relying solely on port numbers has been shown to be ineffective [125, 228, 320], largely due to the use of dynamic port negotiation, tunneling and misuse of port numbers assigned to well-known applications for obfuscating traffic and avoiding firewalls [54, 109, 176, 286].”
Deep packet: a novel approach for encrypted traffic classification using deep learning (2017, background): “According to [30, 28] only 30% to 70% of the current Internet traffic can be classified using port-based classification methods.”
A Survey on Internet Traffic Identification (2009, background): “It is already widely accepted that the use of well-known ports on its own to identify applications is obsolete [8][9][10][11].”
Automated traffic classification and application identification using machine learning (2005, background): “Research on combining different non-ML techniques to identify network applications is presented in [17].”
Offline/realtime traffic classification using semi-supervised learning (2007, background): “Techniques that rely on inspection of packet contents [15, 20,22,28] have been proposed to address the diminished effectiveness of port-based classification.”
A survey of techniques for internet traffic classification using machine learning (2008, methodology): “Moore and Papagiannaki [20] observed no better than 70% byte accuracy for port-based classification using the official IANA list.”
Internet traffic classification demystified: myths, caveats, and the best practices (2008, methodology): “More recently, increasingly popular applications such as those that support peer-to-peer (P2P) file sharing, hide their identity by assigning ports dynamically and/or using well-known ports of other applications, rendering port-based classification less reliable [24, 30, 37].”
Traffic classification through simple statistical fingerprinting (2007, methodology): “[13] also try to identify classes of traffic, instead of focusing on the classification of specific application layer protocols.”
BLINC: multilevel traffic classification in the dark (2005, background): “Indeed, studies have confirmed the failure of port-based classification [14].”
A Survey of Payload-Based Traffic Classification Approaches (2014, background): “As described in [10] and [11] only 30%-70% of the traffic generated by certain protocols can be”