KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Open accessAbstract
This paper proposes KISS, a novel Internet classification engine. Motivated by the expected raise of UDP traffic, which stems from the momentum of Peer-to-Peer (P2P) streaming applications, we propose a novel classification framework that leverages on statistical characterization of payload. Statistical signatures are derived by the means of a Chi-Square (χ2)-like test, which extracts the protocol “format,” but ignores the protocol “semantic” and “synchronization” rules. The signatures feed a decision process based either on the geometric distance among samples, or on Support Vector Machines. KISS is very accurate, and its signatures are intrinsically robust to packet sampling, reordering, and flow asymmetry, so that it can be used on almost any network. KISS is tested in different scenarios, considering traditional client-server protocols, VoIP, and both traditional and new P2P Internet applications. Results are astonishing. The average True Positive percentage is 99.6%, with the worst case equal to 98.1,% while results are almost perfect when dealing with new P2P streaming applications.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The SVM classifier using Pearson's Chi-square signatures distinguishes between the classes of interest with an average true positive rate of 99.6%.
“The signatures are then used to train a SVM classifier that distinguishes between the classes of interest with an average TP of 99.6%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [146]
False positives for the SVM classifier using Pearson's Chi-square signatures are more sensitive to window size and reduce below 5% only for window sizes over 80.
“However, FP are more sensitive to the window size, and reduce below 5% only for window sizes over 80.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [146]
Supervised payload-based traffic classification is not widely applicable and is highly sensitive to the observation window size.
“However, it is not widely applicable and is highly sensitive to the observation window size.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [146]
Long-lived UDP traffic lends itself to supervised payload-based traffic classification, where payload is inspected randomly in an observation window.
“On the other hand, long-lived UDP traffic lends itself to supervised payload-based traffic classification, where payload is inspected randomly in an observation window [146].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [146]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
LIBSVM: A library for support vector machines
Chang, C.-C., & Lin, C.-J. (2011) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/1961189.1961199 · Cited by 40,918 · see citing works
An Introduction to Support Vector Machines and Other Kernel-based Learning Methods
Cristianini, N., & Shawe-Taylor, J. (2000) · doi:10.1017/cbo9780511801389 · Cited by 13,855 · see citing works
Libsvm : A library for support vector machines
Ferrari, V. (2008) · Medical Entomology and Zoology · Cited by 10,124 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Transport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Empirically derived analytic models of wide-area TCP connections
Paxson, V. (1994) · IEEE/ACM Transactions on Networking · doi:10.1109/90.330413 · Cited by 581 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Karagiannis, T., Broido, A., Brownlee, N., Claffy, K. C., & Faloutsos, M. (2005) · IEEE Global Telecommunications Conference, 2004. GLOBECOM '04. · doi:10.1109/glocom.2004.1378239 · Cited by 504 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Profiling internet backbone traffic
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080112 · Cited by 337 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Bonfiglio, D., Mellia, M., Meo, M., Rossi, D., & Tofanelli, P. (2007) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1282380.1282386 · Cited by 268 · see citing works
Self-citationUnexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
An analysis of Internet chat systems
Dewes, C., Wichmann, A., & Feldmann, A. (2003) · doi:10.1145/948205.948214 · Cited by 149 · see citing works
The eMule Protocol Specification
Kulbak, Y., Bickson, D., & Kirkpatrick, S. (2005) · Cited by 115 · see citing works
Measuring IP and TCP behavior on edge nodes with Tstat
Mellia, M., Cigno, R. L., & Neri, F. (2004) · Computer Networks · doi:10.1016/j.comnet.2004.06.026 · Cited by 80 · see citing works
Self-citationUnderstanding VoIP from Backbone Measurements
Birke, R., Mellia, M., Petracca, M., et al. (2007) · doi:10.1109/infcom.2007.235 · Cited by 52 · see citing works
Self-citationKISS: Stochastic Packet Inspection
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01645-5_14 · Cited by 40 · see citing works
Self-citationMeasuring IP and TCP behavior on edge nodes with Tstat
Mellia, M., Cigno, R. L., & Neri, F. (2005) · Computer Networks · doi:10.1016/s1389-1286(04)00201-4 · Cited by 39 · see citing works
Self-citationLeonardi, E., Mellia, M., Horváth, Á., et al. (2008) · IEEE Communications Magazine · doi:10.1109/mcom.2008.4481334 · Cited by 32 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 6
- D. Bonfiglio, M. Mellia, M. Meo, D. Rossi, and P. Tofanelli, "Re- vealing Skype traffic: When randomness plays with you," in Proc. ACM SIGCOMM, Kyoto, Japan, Aug. 2007, pp. 37-48.
- P. Haffner, S. Sen, O. Spatscheck, and D. Wang, "ACAS: Automated construction of application signatures," in Proc. ACM SIGCOMM Workshop Minenet, Philadelphia, PA, Aug. 2005, pp. 197-202.
- L. Bernaille, R. Teixeira, and K. Salamatian, "Early application iden- tification," in Proc. CoNEXT, Lisboa, Portugal, Dec. 2006, Article No. 6.
- Marco Mellia (SM'08) received the Ph.D. degree in telecommunications engineering from Politecnico di Torino, Torino, Italy, in 2001. In 1999, he was with the Computer Science Department, Carnegie Mellon University, Pittsburgh, PA. Since April 2001, he has been with the Electrical Engineering Department, Politecnico di Torino. He has coauthored over 140 papers published in interna- tional journals and conferences, and he participated in the program committees of several conferences including IEEE INFOCOM and ACM SIGCOMM. His research interests are in the fields of traffic measurement, P2P applications, and energy-aware network design.
- Dr. Meo was Program Co-Chair of two ACM MSWiM conferences; General Chair of another ACM MSWiM conference; Program Co-Chair of IEEE QoS-IP, IEEE MoVeNet 2007, and IEEE ISCC 2009; and a program committee member of about 50 international conferences, including ACM SIGMETRICS, IEEE INFOCOM, IEEE ICC, and IEEE GLOBECOM.
- Dario Rossi (M'02) received the Ph.D. degree in electronic and telecommunication engineering from Politecnico di Torino, Torino, Italy, in 2005. From 2003 to 2004, he was with the Computer Sci- ence Department, University of California, Berkeley. Since October 2006, he has been an Associate Pro- fessor with Telecom ParisTech, Paris, France. He has coauthored over 40 papers in leading conferences and journals. He participated in the program committees of several conferences like IEEE ICC, IEEE IPCCC, and IEEE GLOBECOM. His research interests in- clude P2P networks, Internet traffic measurement, and sensor and vehicular net- works.
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Abacus: Accurate behavioral classification of P2P-TV traffic
Bermolen, P., Mellia, M., Meo, M., Rossi, D., & Valenti, S. (2011) · Computer Networks · doi:10.1016/j.comnet.2010.12.004 · Cited by 67 · see citing works
Self-citation
- Authors
- Finamore, A., Mellia, M., Meo, M., & Rossi, D.
- Affiliations
- Politecnico di Torino (IT)
- Télécom Paris (FR)
- Venue
- IEEE/ACM Transactions on Networking
- Published
- 2010-10
- Volume
- 18
- Issue
- 5
- Pages
- 1505-1515
- ISSN
- 1063-6692 (ISSN-L)
- 1558-2566
- OpenAlex
- W2137831706
- Cited by
- 130
- References
- 31
- Citations by year
- 2026: 1 · 2025: 1 · 2024: 4 · 2023: 3 · 2022: 12 · 2021: 15 · 2020: 10 · 2019: 4 · 2018: 11 · 2017: 4 · 2016: 9 · 2015: 17 · 2014: 11 · 2013: 8 · 2012: 10
- FWCI
- 8.80
- Type
- journal article
- Language
- en
- Open access
- Locations
- IEEE/ACM Transactions on Networking (publishedVersion)
- PORTO@Iris (submittedVersion, other-oa)
- PORTO Publications Open Repository TOrino (Politecnico di Torino) (submittedVersion, other-oa)
- Funders
- Cisco Systems
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- packet inspection, statistical signatures, chi-square test, peer-to-peer streaming, VoIP, support vector machine, flow asymmetry, network traffic classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
