Inferring applications at the network layer using collective traffic statistics
Abstract
Operating, managing and securing networks require a thorough understanding of the demands placed on the network by the endpoints it interconnects, the characteristics of the traffic the endpoints generate, and the distribution of that traffic over the resources of the network infrastructure. A major differentiator in the types of resource required by traffic is the class of endpoint application that generates it. Service providers determine the application mix present in traffic via measurements, e.g., flow measurements furnished by routers. Previous work has shown that a fairly accurate determination of application type can be made from this data. However, protocol level information, such as TCP/UDP ports and other parts of the transport header, and also parts of the network header in some cases, may not be accessible due to the use of encryption or tunneling protocols by endpoints or gateways. Furthermore, the utility of ports as signifiers of application type has some limitations due to abuse and non-standard usage, amongst other reasons. These factors reduce the classification accuracy. In this paper, we propose a novel technique for inferring the distribution of application classes present in the aggregated traffic flows between endpoints, that exploits both the measured statistics of the traffic flows, and the spatial distribution of those flows across the network. Our method employs a two-step supervised model, where the bootstrapping step provides initial (inaccurate) inference on the traffic application classes, and the graph-based calibration step adjusts the initial inference through the collective spatial traffic distribution. In evaluations using real traffic flow measurements from a large ISP, we show how our method can accurately classify application types within aggregate traffic between endpoints, even without knowledge of ports and other traffic features. While the bootstrap estimate classifies the aggregates with 80% accuracy, incorporating spatial distributions through calibration increases the accuracy to 92%, i.e., roughly halving the number of errors.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Employing collective traffic statistics via colored traffic activity graphs improves accuracy for all traffic classes, reducing the overall error rate by 15%.
“By employing collective traffic statistics [221] via colored traffic activity graphs (TAGs) improves the accuracy for all traffic classes, reducing the overall error rate by 15%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [221]
Cites
Seel, N. M. (2012) · Springer eBooks · doi:10.1007/978-1-4419-1428-6_5195 · Cited by 19,525 · see citing works
Chiang, L. H., Russell, E. L., & Braatz, R. D. (2001) · Advanced textbooks in control and signal processing · doi:10.1007/978-1-4471-0347-9_3 · Cited by 5,053 · see citing works
Collective Classification in Network Data
Sen, P., Namata, G., Bilgic, M., Getoor, L., Gallagher, B., & Eliassi‐Rad, T. (2008) · AI Magazine · doi:10.1609/aimag.v29i3.2157 · Cited by 3,293 · see citing works
Security Architecture for the Internet Protocol
Atkinson, R. J. (1995) · doi:10.17487/rfc1825 · Cited by 2,768 · see citing works
BoosTexter: A Boosting-based System for Text Categorization
Schapire, R. E., & Singer, Y. (2000) · Machine Learning · doi:10.1023/a:1007649029923 · Cited by 2,191 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Security Architecture for the Internet Protocol
Kent, S., & Atkinson, R. J. (1998) · doi:10.17487/rfc2401 · Cited by 891 · see citing works
Security Architecture for the Internet Protocol
Kent, S., & Seo, K.-J. (2005) · doi:10.17487/rfc4301 · Cited by 868 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Generic Routing Encapsulation (GRE)
Farinacci, D., Li, T., Hanks, S., Meyer, D., & Traina, P. (2000) · doi:10.17487/rfc2784 · Cited by 529 · see citing works
Deriving traffic demands for operational IP networks: methodology and experience
Feldmann, A., Greenberg, A. G., Lund, C., Reingold, N., Rexford, J., & True, F. (2001) · IEEE/ACM Transactions on Networking · doi:10.1109/90.929850 · Cited by 434 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Self-citationBLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Network monitoring using traffic dispersion graphs (tdgs)
Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S. R., & Varghese, G. (2007) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298349 · Cited by 190 · see citing works
A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks
Jin, Y., Duffield, N. G., Erman, J., Haffner, P., Sen, S. B., & Zhang, Z. (2012) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2133360.2133364 · Cited by 103 · see citing works
Self-citationJin, Y., Sharafuddin, E., & Zhang, Z.-L. (2009) · doi:10.1145/1555349.1555356 · Cited by 70 · see citing works
Self-citationEnterprise Security: A Community of Interest Based Approach.
McDaniel, P. D., Sen, S. B., Spatscheck, O., van der Merwe, J. E., Aiello, W. A., & Kalmanek, C. R. (2006) · Cited by 62 · see citing works
Self-citationExploiting dynamicity in graph-based traffic analysis
Iliofotou, M., Faloutsos, M., & Mitzenmacher, M. (2009) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/1658939.1658967 · Cited by 61 · see citing works
Lightweight application classification for network management
Jiang, H., Moore, A. W., Ge, Z., Jin, S., & Wang, J. (2007) · IEEE Internet Network Management Workshop · doi:10.1145/1321753.1321771 · Cited by 54 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks
Jin, Y., Duffield, N. G., Erman, J., Haffner, P., Sen, S. B., & Zhang, Z. (2012) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2133360.2133364 · Cited by 103 · see citing works
Self-citationProcedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey
Sheikh, M. S., & Peng, Y. (2022) · IEEE Access · doi:10.1109/access.2022.3181135 · Cited by 59 · see citing works
Using host profiling to refine statistical application identification
Jaber, M., Cascella, R. G., & Barakat, C. (2012) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2012.6195692 · Cited by 18 · see citing works
CUFTI: Methods for core users finding and traffic identification in P2P systems
Qin, T., Wang, L., Zhao, D., & Zhu, M. (2015) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-015-0350-2 · Cited by 4 · see citing works
Detecting P2P traffic from the P2P flow graph
Kim, J., Shah, K., & Bohacek, S. K. (2011) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2011.5982807 · Cited by 3 · see citing works
Levchuk, G., Colonna‐Romano, J., & Eslami, M. (2017) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.2263543 · Cited by 3 · see citing works
- Authors
- Jin, Y., Duffield, N., Haffner, P., Sen, S., & Zhang, Z.-L.
- Affiliations
- University of Minnesota (US)
- AT&T (United States) (US)
- Venue
- 2010 22nd International Teletraffic Congress (lTC 22)
- Publisher
- IEEE
- Published
- 2010-09
- Pages
- 1-8
- OpenAlex
- W2002151811
- Cited by
- 7
- References
- 22
- Citations by year
- 2022: 1 · 2018: 1 · 2017: 1 · 2015: 1 · 2012: 2
- FWCI
- 0.78
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Teletraffic Congress (publishedVersion)
- Funders
- National Science Foundation
- Defense Threat Reduction Agency
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Traffic and Congestion Control
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Keywords
- network traffic classification, bootstrapping, encrypted traffic, tunneling protocols, network resource allocation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
