Toward Classifying Unknown Application Traffic
Toward Classifying Unknown Application Traffic
复制标题
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Ryan Baker;Ren Quinn
中科院分区：
文献类型：
--
作者：
Ryan Baker;Ren Quinn
确定与给定的互联网流量相关的特定应用程序是计算机网络中的重要安全措施。这种做法很重要，因为它可以帮助检测入侵和其他异常情况，以及识别与禁止的应用程序相关的滥用行为。人们付出了许多努力来创建使用机器学习技术对互联网流量进行分类的模型。虽然迄今为止的研究已被证明是有用的，但研究重点是用于检测众所周知的和经过分析的应用程序的机器学习技术。有些只关注特定的传输层流量（例如，仅 TCP 流量）。相比之下，未知流量更难以分类，并且可能显示为以前未见过的应用程序或表现出异常行为的已建立应用程序。这项工作提出了解决其他研究中这些差距的方法。这些方法利用 k-最近邻机器学习方法对已知应用数据进行建模，并使用 Kolmogorov-Smirnov 统计量作为与计算机最近邻的距离函数。这些模型识别可能不属于该模型的传入数据，从而识别未知的应用程序。这项研究通过展示在受控环境（例如拥有固定数量已批准应用程序的组织）中成功实施的结果来展示我们方法的潜力。在此设置中，我们的方法可以区分未知数据和已知数据，准确度高达 93%，而采用欧几里德距离的稻草人 k 最近邻方法的准确度为 57%。此外，对特定协议没有限制。还讨论了操作注意事项，重点是未来可以执行的工作，例如探索实时传入数据的处理和以自动化方式更新模型。 ACM 参考格式：Ryan Baker、Ren Quinn、Jeff Phillips 和 Jacobus van der Merwe。 2018。对未知应用程序流量进行分类。 In Proceedings of DYNAMICS’18，美国波多黎各圣胡安，2018 年 12 月，8 页。允许免费制作本作品全部或部分内容的数字或硬拷贝以供个人或课堂使用，前提是制作或分发副本不是为了盈利或商业利益，并且副本在首页上附有此通知和完整引用。必须尊重 ACM 以外的其他人拥有的本作品组件的版权。允许以信用方式提取。要以其他方式复制、重新发布、发布到服务器上或重新分发到列表，需要事先获得特定许可和/或付费。从permissions@acm.org 请求权限。 DYNAMICS’18，2018 年 12 月，美国波多黎各圣胡安 © 2018 计算机协会。 ACM 国际书号。
Determining the particular application associated with a given flow of internet traffic is an important security measure in computer networks. This practice is significant as it can aid in detecting intrusions and other anomalies, as well as identifying misuse associated with prohibited applications. Many efforts have been expended to create models for classifying internet traffic using machine learning techniques. While research so far has proven useful, studies have focused on machine learning techniques for detecting well-known and profiled applications. Some have focused only on particular transport layer traffic (e.g., TCP traffic only). In contrast, unknown traffic is muchmore difficult to classify and can appear as previously unseen applications or established applications exhibiting abnormal behavior. This work presents methods to address these gaps in other research. The methods utilize k-Nearest Neighbor machine learning approaches to model known application data with the Kolmogorov-Smirnov statistic as the distance function to computer nearest neighbors. The models identify incoming data which likely does not belong to the model, thus identifying unknown applications. This study shows the potential of our approach by presenting results which show successful implementation for a controlled environment, such as an organization with a fixed number of approved applications. In this setting, our approach can distinguish unknown data from known data with accuracy up to 93 percent compared to an accuracy of 57 percent for a strawman k-Nearest Neighbors approach with Euclidean distance. In addition, there are no restrictions on particular protocols. Operational considerations are also discussed, with emphasis on future work that can be performed such as exploring processing of incoming data in real-time and updating the model in an automated way. ACM Reference format: Ryan Baker, Ren Quinn, Jeff Phillips, and Jacobus van der Merwe. 2018. Toward Classifying Unknown Application Traffic. In Proceedings of DYNAMICS’18, San Juan, Puerto Rico, USA, December 2018, 8 pages. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. DYNAMICS’18, December 2018, San Juan, Puerto Rico, USA © 2018 Association for Computing Machinery. ACM ISBN .