Traffic classification on the fly
Open accessAbstract
The early detection of applications associated with TCP flows is an essential step for network security and traffic engineering. The classic way to identify flows, i.e. looking at port numbers, is not effective anymore. On the other hand, state-of-the-art techniques cannot determine the application before the end of the TCP flow. In this editorial, we propose a technique that relies on the observation of the first five packets of a TCP connection to identify the application. This result opens a range of new possibilities for online traffic classification.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The text we found for this paper looks like another document, so the self-check wasn’t run.
Cites
(1967) · Cited by 23,719 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Karagiannis, T., Broido, A., Brownlee, N., Claffy, K. C., & Faloutsos, M. (2005) · IEEE Global Telecommunications Conference, 2004. GLOBECOM '04. · doi:10.1109/glocom.2004.1378239 · Cited by 504 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Hohn, N., & Veitch, D. (2003) · doi:10.1145/948205.948235 · Cited by 158 · see citing works
Traffic Classification Using a Statistical Approach
Zuev, D., & Moore, A. W. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_25 · Cited by 140 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
Self-citationUnexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
Machine learning based encrypted traffic classification: Identifying SSH and Skype
Alshammari, R., & Zincir-Heywood, A. N. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356534 · Cited by 202 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
Internet Traffic Classification Using Machine Learning: A Token-based Approach
Wang, Y., Xiang, Y., & Yu, S. (2011) · 2011 14th IEEE International Conference on Computational Science and Engineering · doi:10.1109/cse.2011.58 · Cited by 15 · see citing works
- Authors
- Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K.
- Affiliations
- LIP6 (FR)
- Technicolor (France) (FR)
- LIP6, Université Pierre et Marie Curie, Paris, FRANCE
- ORCID
- Teixeira, Renata
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 2006-04-28
- Volume
- 36
- Issue
- 2
- Pages
- 23-26
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W2119271160
- Cited by
- 585
- References
- 8
- Citations by year
- 2026: 12 · 2025: 12 · 2024: 11 · 2023: 17 · 2022: 19 · 2021: 25 · 2020: 36 · 2019: 24 · 2018: 25 · 2017: 29 · 2016: 34 · 2015: 33 · 2014: 36 · 2013: 47 · 2012: 22
- Type
- journal article
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- ACM SIGCOMM Computer Communication Review (publishedVersion)
- HAL (submittedVersion, other-oa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- network traffic classification, TCP flows, application identification, early detection, online classification, network security, traffic engineering, port numbers
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
