BitCoding: Network Traffic Classification Through Encoded Bit Level Signatures
BitCoding: Network Traffic Classification Through Encoded Bit Level Signatures
复制标题
DOI：
10.1109/tnet.2018.2868816
复制
发表时间：
2018-10-01
影响因子：
3.7
通讯作者：
Swarnkar, Mayank
中科院分区：
文献类型：
--
作者：
Hubballi, Neminath;Swarnkar, Mayank
由于许多网络协议使用混淆技术来隐藏其身份，因此需要健壮的流量分类方法。在传统的深度包检测（DPI）方法中，应用特定的签名是由负载中的字节级数据生成的。越来越多的新数据格式被用于用比特级信息对应用协议进行编码，这使得字节级签名无效。本文描述了一种基于位级dpi的签名生成技术——比特编码。比特编码仅使用流中的少量初始位，并将不变位标识为签名。随后，将这些位签名编码并转换为新定义的状态转换机转换约束计数自动机。虽然短签名的处理效率很高，但随着签名（应用程序）数量的增加，这将增加冲突和交叉签名匹配的可能性。我们描述了一种使用汉明距离变体的签名相似度检测方法，并提出增加协议子集的签名长度以避免重叠。我们用三个不同的数据集进行了广泛的实验，这些数据集由537380个流组成，数据包计数为3445969，结果表明，BitCoding在不同类型的协议（文本、二进制和专有）中具有非常好的检测性能，使其与协议类型无关。此外，为了理解生成的签名的可移植性，我们执行了交叉评估，即，从一个站点生成的签名用于与来自其他站点的数据进行测试，以得出结论，它将导致检测性能的小妥协。
With many network protocols using obfuscation techniques to hide their identity, robust methods of traffic classification are required. In traditional deep-packet-inspection (DPI) methods, application specific signatures are generated with byte-level data from payload. Increasingly new data formats are being used to encode the application protocols with bit-level information which render the byte-level signatures ineffective. In this paper, we describe BitCoding a bit-level DPI-based signature generation technique. BitCoding uses only a small number of initial bits from a flow and identify invariant bits as signature. Subsequently, these bit signatures are encoded and transformed into a newly defined state transition machine transition constrained counting automata. While short signatures are efficient for processing, this will increase the chances of collision and cross signature matching with increase in number of signatures (applications). We describe a method for signature similarity detection using a variant of Hamming distance and propose to increase the length of signatures for a subset of protocols to avoid overlaps. We perform extensive experiments with three different data sets consisting of 537380 flows with a packet count of 3445969 and show that, BitCoding has very good detection performance across different types of protocols (text, binary, and proprietary) making it protocol-type agnostic. Further, to understand the portability of signatures generated we perform cross evaluation, i.e., signatures generated from one site are used for testing with data from other sites to conclude that it will lead to a small compromise in detection performance.