SANTaClass: A Self Adaptive Network Traffic Classification system
SANTaClass: A Self Adaptive Network Traffic Classification system
复制标题
DOI：
--
复制
发表时间：
2013-05
期刊：
影响因子：
--
通讯作者：
A. Tongaonkar;Ram Keralapura;A. Nucci
中科院分区：
文献类型：
--
作者：
A. Tongaonkar;Ram Keralapura;A. Nucci
从运营商的角度来看，网络管理的一个关键方面是理解或分类穿过网络的所有流量的能力。基于端口的流量分类技术的失败引发了人们对基于数据包内容发现签名的兴趣。然而，该方法涉及手动地对需要被识别的所有应用/协议进行逆向工程。这受到可伸缩性问题的困扰;跟上每天出现的新应用程序是非常具有挑战性和耗时的。此外，传统的方法开发一次签名并在不同的网络中使用它们，覆盖率低。在这项工作中，我们提出了一种新的全自动的数据包有效载荷内容（PPC）的网络流量分类系统，解决了上述缺点。我们的系统在需要分类的网络中学习新的应用程序签名。此外，我们的系统适应签名的流量为应用程序的变化。基于来自多个服务提供商的真实的跟踪，我们证明了我们的系统能够检测（1）隧道或包装的应用程序，（2）使用随机端口的应用程序，以及（3）新的应用程序。此外，它对路由不对称（大型ISP的重要要求）具有鲁棒性，并且具有非常高的检测率（>99.5%）。最后，我们的系统易于部署和设置，并实时执行分类。
A critical aspect of network management from an operator's perspective is the ability to understand or classify all traffic that traverses the network. The failure of port based traffic classification technique triggered an interest in discovering signatures based on packet content. However, this approach involves manually reverse engineering all the applications/protocols that need to be identified. This suffers from the problem of scalability; keeping up with the new applications that come up everyday is very challenging and time-consuming. Moreover, traditional approach of developing signatures once and using them in different networks suffers from low coverage. In this work, we present a novel fully automated packet payload content (PPC) based network traffic classification system that addresses the above shortcomings. Our system learns new application signatures in the network where classification is desired. Further more, our system adapts the signatures as the traffic for an application changes. Based on real traces from several service providers, we show that our system is capable of detecting (1) tunneled or wrapped applications, (2) applications that use random ports, and (3) new applications. Moreover, it is robust to routing asymmetry, an important requirement in large ISPs, and has a very high (>99.5%) detection rate. Finally, our system is easy to deploy and setup and performs classification in real-time.