BLINC: multilevel traffic classification in the dark
Abstract
We present a fundamentally different approach to classifying traffic flows according to the applications that generate them. In contrast to previous methods, our approach is based on observing and identifying patterns of host behavior at the transport layer. We analyze these patterns at three levels of increasing detail (i) the social, (ii) the functional and (iii) the application level. This multilevel approach of looking at traffic flow is probably the most important contribution of this paper. Furthermore, our approach has two important features. First, it operates in the dark , having (a) no access to packet payload, (b) no knowledge of port numbers and (c) no additional information other than what current flow collectors provide. These restrictions respect privacy, technological and practical constraints. Second, it can be tuned to balance the accuracy of the classification versus the number of successfully classified traffic flows. We demonstrate the effectiveness of our approach on three real traces. Our results show that we are able to classify 80%-90% of the traffic with more than 95% accuracy.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The accuracy of host behavior-based traffic classification strongly depends on the location of the monitoring system, especially because the observed communication pattern may be affected by routing asymmetries in the network core.
“However, the accuracy of the host behavior-based traffic classification strongly depends on the location of the monitoring system, especially since the observed communication pattern may be affected by routing asymmetries in the network core [229].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [229]
Cites
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Self-citationTransport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Self-citationFlow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460 · see citing works
Computing Science and Statistics
(1992) · Springer eBooks · doi:10.1007/978-1-4612-2856-1 · Cited by 458 · see citing works
Analyzing peer-to-peer traffic across large networks
Sen, S. B., & Wang, J. (2002) · doi:10.1145/637201.637222 · Cited by 293 · see citing works
Automatically inferring patterns of resource consumption in network traffic
Estan, C., Savage, S., & Varghese, G. (2003) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/863955.863972 · Cited by 289 · see citing works
Fully automatic cross-associations
Chakrabarti, D., Papadimitriou, S., Modha, D. S., et al. (2004) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1014052.1014064 · Cited by 244 · see citing works
An analysis of Internet chat systems
Dewes, C., Wichmann, A., & Feldmann, A. (2003) · doi:10.1145/948205.948214 · Cited by 149 · see citing works
The architecture of CoralReef: an Internet traffic monitoring software suite
Keys, K., Moore, D., Koga, R., Lagache, E., Tesch, M., & claffy, K. (2001) · Cited by 121 · see citing works
Profiling internet backbone traffic
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080112 · Cited by 118 · see citing works
BLINC: Multilevel Traffic Classification in the Dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · eScholarship (California Digital Library) · Cited by 88 · see citing works
Self-citationAnalysis of Communities of Interest in Data Networks
Aiello, W. A., Kalmanek, C. R., McDaniel, P. D., et al. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_7 · Cited by 65 · see citing works
Statistical Clustering of Internet Communication Patterns
Hernández-Campos, F., Smith, F. D., Jeffay, K., et al. (2003) · Cited by 50 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Soysal, M., & Schmidt, E. G. (2010) · Performance Evaluation · doi:10.1016/j.peva.2010.01.001 · Cited by 165 · see citing works
A Machine Learning Approach for Efficient Traffic Classification
Li, W., & Moore, A. W. (2007) · 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2007.2 · Cited by 154 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
Abacus: Accurate behavioral classification of P2P-TV traffic
Bermolen, P., Mellia, M., Meo, M., Rossi, D., & Valenti, S. (2011) · Computer Networks · doi:10.1016/j.comnet.2010.12.004 · Cited by 67 · see citing works
Inferring applications at the network layer using collective traffic statistics
Jin, Y., Duffield, N., Haffner, P., Sen, S., & Zhang, Z.-L. (2010) · 2010 22nd International Teletraffic Congress (lTC 22) · doi:10.1109/itc.2010.5608729 · Cited by 7 · see citing works
- Authors
- Karagiannis, T., Papagiannaki, K., & Faloutsos, M.
- Affiliations
- University of California, Riverside (US)
- Intel (United States) (US)
- ORCID
- Faloutsos, Michalis
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 2005-08-22
- Volume
- 35
- Issue
- 4
- Pages
- 229-240
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W4236506014
- Cited by
- 354
- References
- 16
- Citations by year
- 2026: 5 · 2025: 1 · 2024: 3 · 2023: 3 · 2022: 11 · 2021: 3 · 2020: 13 · 2019: 13 · 2018: 16 · 2017: 7 · 2016: 19 · 2015: 22 · 2014: 27 · 2013: 37 · 2012: 26
- FWCI
- 19.39
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ACM SIGCOMM Computer Communication Review (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- application-level traffic classification, multi-level classification, network traffic analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
