Unexpected means of protocol inference
Abstract
Network managers are inevitably called upon to associate network traffic with particular applications. Indeed, this operation is critical for a wide range of management functions ranging from debugging and security to analytics and policy support. Traditionally, managers have relied on application adherence to a well established global port mapping: Web traffic on port 80, mail traffic on port 25 and so on. However, a range of factors - including firewall port blocking, tunneling, dynamic port allocation, and a bloom of new distributed applications - has weakened the value of this approach. We analyze three alternative mechanisms using statistical and structural content models for automatically identifying traffic that uses the same application-layer protocol, relying solely on flow content. In this manner, known applications may be identified regardless of port number, while traffic from one unknown application will be identified as distinct from another. We evaluate each mechanism's classification performance using real-world traffic traces from multiple sites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Statistical and structural content models are good at inferring discriminators for binary, textual and structural content.
“These models are good at inferring discriminators for binary, textual and structural content [286].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
Payload-based traffic classification can be performed without any a priori knowledge of the application classes using unsupervised clustering.
“Ma et al. [286] show that payload-based traffic classification can be performed without any a priori knowledge of the application classes using unsupervised clustering.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
Relying solely on port numbers has been shown to be ineffective, largely due to the use of dynamic port negotiation, tunneling and misuse of port numbers assigned to well-known applications for obfuscating traffic and avoiding firewalls.
“Furthermore, relying solely on port numbers has been shown to be ineffective [125,228,320], largely due to the use of dynamic port negotiation, tunneling and misuse of port numbers assigned to well-known applications for obfuscating traffic and avoiding firewalls [54,109,176,286].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
In Ma et al.'s evaluation, the product distribution (PD)-based protocol models resulted in the lowest total misclassification error, under 5%.
“In evaluation, the PD-based protocol models resulted in the lowest total misclassification error, under 5%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
Cites
Elements of Information Theory
Cover, T. M., & Thomas, J. A. (2001) · Wiley eBooks · doi:10.1002/0471200611 · Cited by 37,139 · see citing works
Identification of common molecular subsequences
Smith, T. F., & Waterman, M. S. (1981) · Journal of Molecular Biology · doi:10.1016/0022-2836(81)90087-5 · Cited by 9,962 · see citing works
Kademlia: A Peer-to-Peer Information System Based on the XOR Metric
Maymounkov, P., & Mazières, D. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45748-8_5 · Cited by 3,022 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
A distance measure between attributed relational graphs for pattern recognition
Sanfeliu, A., & Fu, K. (1983) · IEEE Transactions on Systems, Man and Cybernetics · doi:10.1109/tsmc.1983.6313167 · Cited by 1,142 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol
Baset, S., & Schulzrinne, H. G. (2006) · doi:10.1109/infocom.2006.312 · Cited by 736 · see citing works
Transport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Packet-level traffic measurements from the sprint IP backbone
Fraleigh, C., Moon, S. B., Lyles, B., Cotton, C., Khan, M., Moll, D., Rockell, R., Seely, T., & Diot, C. (2003) · IEEE Network · doi:10.1109/mnet.2003.1248656 · Cited by 639 · see citing works
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585 · see citing works
Karagiannis, T., Broido, A., Brownlee, N., Claffy, K. C., & Faloutsos, M. (2005) · IEEE Global Telecommunications Conference, 2004. GLOBECOM '04. · doi:10.1109/glocom.2004.1378239 · Cited by 504 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
The nature of the beast: Recent traffic measurements from an Internet backbone
claffy, K., Miller, G., & Thompson, K. (1998) · Cited by 349 · see citing works
FlowScan: A Network Traffic Flow Reporting and Visualization Tool
Plonka, D. (2000) · Cited by 168 · see citing works
An analysis of Internet chat systems
Dewes, C., Wichmann, A., & Feldmann, A. (2003) · doi:10.1145/948205.948214 · Cited by 149 · see citing works
Self-Learning IP Traffic Classification Based on Statistical Flow Characteristics
Zander, S., Thu, T. N. T., & Armitage, G. J. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_26 · Cited by 116 · see citing works
An Analysis of the Skype Peer-to-Peer Internet Telephony ProtocolPreprint
Baset, S., & Schulzrinne, H. G. (2004) · arXiv (Cornell University) · doi:10.48550/arxiv.cs/0412017 · Cited by 110 · see citing works
Hyper customized processors for bio-sequence database scanning on FPGAs
Oliver, T., Schmidt, B., & Maskell, D. L. (2005) · ACM/SIGDA International Symposium on Field-Programmable Gate Arrays (FPGA) · doi:10.1145/1046192.1046222 · Cited by 99 · see citing works
Using Graphics Hardware to Accelerate Biological Sequence Database Scanning
Voß, G., Müller‐Wittig, W., Schmidt, B., & Schroder, A. (2005) · IEEE Region 10 Conference (TENCON) · doi:10.1109/tencon.2005.300995 · Cited by 5 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
Caballero, J., Yin, H., Liang, Z., & Song, D. X. (2007) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1315245.1315286 · Cited by 372 · see citing works
Network Traffic Classification Using Correlation Information
Zhang, J., Xiang, Y., Wang, Y., Zhou, W., Xiang, Y., & Guan, Y. (2012) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2012.98 · Cited by 329 · see citing works
Discoverer: automatic protocol reverse engineering from network traces
Cui, W., Kannan, J., & Wang, H. J. (2007) · Cited by 304 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Shafiq, M., Tian, Z., Bashir, A. K., Jolfaei, A., & Yu, X. (2020) · Sustainable Cities and Society · doi:10.1016/j.scs.2020.102177 · Cited by 227 · see citing works
Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution.
Lin, Z., Jiang, X., Xu, D., & Zhang, X. (2008) · Cited by 206 · see citing works
Early Recognition of Encrypted Applications
Bernaille, L., & Teixeira, R. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-71617-4_17 · Cited by 200 · see citing works
Shen, M., Wei, M., Zhu, L., & Wang, M. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2692682 · Cited by 200 · see citing works
Cloud control with distributed rate limiting
Raghavan, B., Vishwanath, K. V., Ramabhadran, S., Yocum, K., & Snoeren, A. C. (2007) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1282380.1282419 · Cited by 197 · see citing works
Network monitoring using traffic dispersion graphs (tdgs)
Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S. R., & Varghese, G. (2007) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298349 · Cited by 190 · see citing works
Automatic network protocol analysis
Wondracek, G. (2008) · Cited by 183 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
A semantics aware approach to automated reverse engineering unknown protocols
Wang, Y., Yun, X., Shafiq, M. Z., Wang, L., Liu, A. X., Zhang, Z., Yao, D. D., Zhang, Y., & Guo, L. (2012) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2012.6459963 · Cited by 146 · see citing works
Detecting DDoS attacks against data center with correlation analysis
Xiao, P., Qu, W., Qi, H., & Li, Z. (2015) · Computer Communications · doi:10.1016/j.comcom.2015.06.012 · Cited by 137 · see citing works
Scan Statistics for the Online Detection of Locally Anomalous Subgraphs
Neil, J., Hash, C., Brugh, A., Fisk, M., & Storlie, C. B. (2013) · Technometrics · doi:10.1080/00401706.2013.822830 · Cited by 134 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
An Effective Network Traffic Classification Method with Unknown Flow Detection
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Vasilakos, A. V. (2013) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2013.022713.120250 · Cited by 125 · see citing works
A Review on Machine Learning Strategies for Real-World Engineering Applications
Jhaveri, R. H., Revathi, A. R., Ramana, K., Raut, R., & Dhanaraj, R. K. (2022) · Mobile Information Systems · doi:10.1155/2022/1833507 · Cited by 124 · see citing works
Byte Segment Neural Network for Network Traffic Classification
Li, R., Xiao, X., Ni, S., Zheng, H.-T., & Xia, S. (2018) · International Workshop on Quality of Service · doi:10.1109/iwqos.2018.8624128 · Cited by 110 · see citing works
A Survey of Automatic Protocol Reverse Engineering Tools
Narayan, J., Shukla, S. K., & Clancy, T. C. (2015) · ACM Computing Surveys · doi:10.1145/2840724 · Cited by 104 · see citing works
A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks
Jin, Y., Duffield, N. G., Erman, J., Haffner, P., Sen, S. B., & Zhang, Z. (2012) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2133360.2133364 · Cited by 103 · see citing works
Reviewing Traffic Classification
Valenti, S., Rossi, D., Dainotti, A., Pescapè, A., Finamore, A., & Mellia, M. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-36784-7_6 · Cited by 103 · see citing works
Inferring Protocol State Machine from Network Traces: A Probabilistic Approach
Wang, Y., Zhang, Z.-B., Yao, D. D., Qu, B., & Guo, L. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-21554-4_1 · Cited by 98 · see citing works
A Semantics-Aware Approach to the Automated Network Protocol Identification
Yun, X., Wang, Y., Zhang, Y., & Zhou, Y. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2381230 · Cited by 95 · see citing works
Position-based automatic reverse engineering of network protocols
Luo, J., & Yu, S. (2013) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2013.01.013 · Cited by 88 · see citing works
Cloud control with distributed rate limiting
Raghavan, B., Vishwanath, K. V., Ramabhadran, S., Yocum, K., & Snoeren, A. C. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1282427.1282419 · Cited by 88 · see citing works
Unsupervised traffic classification using flow statistical properties and IP packet payload
Zhang, J., Xiang, Y., Zhou, W., & Wang, Y. (2012) · Journal of Computer and System Sciences · doi:10.1016/j.jcss.2012.11.004 · Cited by 84 · see citing works
Eavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic
Saltaformaggio, B., Choi, H., Johnson, K., Kwon, Y., Zhang, Q., Zhang, X., Xu, D., & Qian, J. (2016) · Cited by 81 · see citing works
Automatic protocol reverse-engineering: Message format extraction and field semantics inference
Caballero, J., & Song, D. X. (2012) · Computer Networks · doi:10.1016/j.comnet.2012.08.003 · Cited by 78 · see citing works
Wang, Y., Xiang, Y., Zhou, W., & Yu, S. (2011) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2011.03.017 · Cited by 69 · see citing works
Towards self adaptive network traffic classification
Tongaonkar, A., Torres, R. D., Iliofotou, M., Keralapura, R., & Nucci, A. (2014) · Computer Communications · doi:10.1016/j.comcom.2014.03.026 · Cited by 69 · see citing works
Abacus: Accurate behavioral classification of P2P-TV traffic
Bermolen, P., Mellia, M., Meo, M., Rossi, D., & Valenti, S. (2011) · Computer Networks · doi:10.1016/j.comnet.2010.12.004 · Cited by 67 · see citing works
Graption: A graph-based P2P traffic classification framework for the internet backbone
Iliofotou, M., Kim, H.-C., Faloutsos, M., Mitzenmacher, M., Pappu, P., & Varghese, G. (2011) · Computer Networks · doi:10.1016/j.comnet.2011.01.020 · Cited by 64 · see citing works
Exploiting dynamicity in graph-based traffic analysis
Iliofotou, M., Faloutsos, M., & Mitzenmacher, M. (2009) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/1658939.1658967 · Cited by 61 · see citing works
Network traffic classification techniques and challenges
Khater, N. A., & Overill, R. E. (2015) · International Conference on Digital Information Management · doi:10.1109/icdim.2015.7381869 · Cited by 60 · see citing works
Semi-automated discovery of application session structure
Kannan, J., Jung, J., Paxson, V., & Koksal, C. E. (2006) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1177080.1177096 · Cited by 60 · see citing works
Graph-Based P2P Traffic Classification at the Internet Backbone
Iliofotou, M., Kim, H.-C., Faloutsos, M., Mitzenmacher, M., Pappu, P., & Varghese, G. (2009) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infcomw.2009.5072151 · Cited by 59 · see citing works
Elephant Flow Detection and Load-Balanced Routing with Efficient Sampling and Classification
Tang, F., Zhang, H., Yang, L. T., & Chen, L. (2019) · IEEE Transactions on Cloud Computing · doi:10.1109/tcc.2019.2901669 · Cited by 55 · see citing works
Zuo, C., Zhao, Q., & Lin, Z. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134089 · Cited by 53 · see citing works
Enabling passive measurement of zoom performance in production networks
Michel, O., Sengupta, S., Kim, H., Netravali, R., & Rexford, J. (2022) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3517745.3561414 · Cited by 51 · see citing works
Erman, J., Mahanti, A., & Arlitt, M. F. (2007) · doi:10.1145/1269880.1269890 · Cited by 51 · see citing works
AutoSig-Automatically Generating Signatures for Applications
Ye, M., Xu, K., Wu, J., & Hu, P. (2009) · IEEE International Conference on Computer and Information Technology (CIT) · doi:10.1109/cit.2009.97 · Cited by 50 · see citing works
Protocol Reverse-Engineering Methods and Tools: A Survey
Huang, Y., Shu, H., Kang, F., & Guang, Y. (2021) · Computer Communications · doi:10.1016/j.comcom.2021.11.009 · Cited by 49 · see citing works
A novel semi-supervised approach for network traffic clustering
Wang, Y., Xiang, Y., Zhang, J., & Yu, S. (2011) · International Conference on Network and System Security (NSS) · doi:10.1109/icnss.2011.6059997 · Cited by 45 · see citing works
Biprominer: Automatic Mining of Binary Protocol Features
Wang, Y., Li, X., Meng, J., Zhao, Y. T., Zhang, Z., & Li, G. (2011) · International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT) · doi:10.1109/pdcat.2011.25 · Cited by 42 · see citing works
Detection and classification of peer-to-peer traffic
Gomes, J. V., Inácio, P. R. M., Pereira, M., Freire, M. M., & Monteiro, P. P. (2013) · ACM Computing Surveys · doi:10.1145/2480741.2480747 · Cited by 42 · see citing works
An automatic application signature construction system for unknown traffic
Wang, Y., Xiang, Y., & Yu, S. (2010) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.1603 · Cited by 42 · see citing works
Profiling and identification of P2P traffic
Hu, Y., Chiu, D. M., & Lui, J. C. S. (2008) · Computer Networks · doi:10.1016/j.comnet.2008.11.005 · Cited by 39 · see citing works
Early Identification of Peer-to-Peer Traffic
Hullár, B., Laki, S., & György, A. (2011) · International Conference on Communications · doi:10.1109/icc.2011.5963023 · Cited by 38 · see citing works
Internet traffic clustering with side information
Wang, Y., Xiang, Y., Zhang, J., Zhou, W., & Xie, B. (2014) · Journal of Computer and System Sciences · doi:10.1016/j.jcss.2014.02.008 · Cited by 37 · see citing works
Breaking and Improving Protocol Obfuscation
Hjelmvik, E., & John, W. (2010) · Chalmers Publication Library (Chalmers University of Technology) · Cited by 37 · see citing works
Zuo, C., Wang, W., Wang, R., & Lin, Z. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23146 · Cited by 36 · see citing works
Identify P2P traffic by inspecting data transfer behavior
Xu, K., Zhang, M., Ye, M., Chiu, D. M., & Wu, J. (2010) · Computer Communications · doi:10.1016/j.comcom.2010.01.005 · Cited by 36 · see citing works
Toward Unsupervised Protocol Feature Word Extraction
Zhang, Z., Zhang, Z., Lee, P. P. C., Liu, Y., & Xie, G. (2014) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2014.2358857 · Cited by 35 · see citing works
Fine‐grained traffic classification based on functional separation
Park, B., Won, Y., Chung, J., Kim, M., & Hong, J. W. (2013) · International Journal of Network Management · doi:10.1002/nem.1837 · Cited by 34 · see citing works
Real-Time Traffic Classification Based on Statistical and Payload Content Features
Dehghani, F., Movahhedinia, N., Khayyambashi, M. R., & Kianian, S. (2010) · International Workshop on Intelligent Systems and Applications (ISA) · doi:10.1109/iwisa.2010.5473467 · Cited by 34 · see citing works
Characterizing Organizational Use of Web-Based Services
Gill, P., Arlitt, M. F., Carlsson, N. F., Mahanti, A., & Williamson, C. L. (2011) · ACM Transactions on the Web · doi:10.1145/2019643.2019646 · Cited by 34 · see citing works
CUTE: Traffic Classification Using TErms
Yeganeh, S. H., Eftekhar, M., Ganjali, Y., Keralapura, R., & Nucci, A. (2012) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn.2012.6289207 · Cited by 34 · see citing works
Detecting Skype flows in Web traffic
Freire, E. P., Ziviani, A., & Salles, R. M. (2008) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms.2008.4575121 · Cited by 34 · see citing works
Iliofotou, M., Gallagher, B. J., Eliassi‐Rad, T., Xie, G., & Faloutsos, M. (2010) · Proceedings of the 6th International Conference · doi:10.1145/1921168.1921171 · Cited by 33 · see citing works
SLIC: Self-Learning Intelligent Classifier for network traffic
Divakaran, D. M., Su, L., Liau, Y. S., & Thing, V. L. L. (2015) · Computer Networks · doi:10.1016/j.comnet.2015.08.021 · Cited by 32 · see citing works
Early traffic classification using support vector machines
Sena, G. G., & Belzarena, P. (2009) · doi:10.1145/1636682.1636693 · Cited by 31 · see citing works
Predicting IPv4 services across all ports
Izhikevich, L., Teixeira, R., & Durumeric, Z. (2022) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/3544216.3544249 · Cited by 30 · see citing works
Using visual motifs to classify encrypted traffic
Wright, C. V., Monrose, F., & Masson, G. M. (2006) · doi:10.1145/1179576.1179584 · Cited by 27 · see citing works
Stochastic Packet Inspection for TCP Traffic
Mantia, G. L., Rossi, D., Finamore, A., Mellia, M., & Meo, M. (2010) · International Conference on Communications · doi:10.1109/icc.2010.5502280 · Cited by 27 · see citing works
Detecting VoIP calls hidden in web traffic
Freire, E. P., Ziviani, A., & Salles, R. M. (2008) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2009.041102 · Cited by 24 · see citing works
Identification of Abnormal Network Traffic Using Support Vector Machine
Kong, L., Huang, G., & Wu, K. (2017) · International Conference on Parallel and Distributed Computing, Applications and Technologies (PDCAT) · doi:10.1109/pdcat.2017.00054 · Cited by 24 · see citing works
Novel dynamic multiple classification system for network traffic
Xiao, X., Li, R., Zheng, H.-T., Ye, R., KumarSangaiah, A., & Xia, S. (2018) · Information Sciences · doi:10.1016/j.ins.2018.10.039 · Cited by 24 · see citing works
Link Homophily in the Application Layer and its Usage in Traffic Classification
Gallagher, B. J., Iliofotou, M., Eliassi‐Rad, T., & Faloutsos, M. (2010) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infcom.2010.5462239 · Cited by 24 · see citing works
Using Entropy to Classify Traffic More Deeply
Wang, Y., Zhang, Z., Guo, L., & Li, S. (2011) · IEEE International Conference on Networking, Architecture and Storage (NAS) · doi:10.1109/nas.2011.18 · Cited by 23 · see citing works
Traffic analysis attacks and countermeasures in wireless body area sensor networks
Buttyán, L., & Holczer, T. (2012) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) · doi:10.1109/wowmom.2012.6263774 · Cited by 23 · see citing works
Machine Learned Real-Time Traffic Classifiers
Wang, Y., & Yu, S. (2008) · Intelligent Information Technology Application · doi:10.1109/iita.2008.536 · Cited by 22 · see citing works
An Efficient Sampling and Classification Approach for Flow Detection in SDN-Based Big Data Centers
Tang, F., Li, L., Barolli, L., & Tang, C. (2017) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2017.125 · Cited by 21 · see citing works
Advanced Network Fingerprinting
Abdelnur, H. J., State, R., & Festor, O. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-87403-4_20 · Cited by 21 · see citing works
Automated Behavioral Fingerprinting
François, J., Abdelnur, H. J., State, R., & Festor, O. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04342-0_10 · Cited by 20 · see citing works
Machine Learning Techniques for Passive Network Inventory
François, J., Abdelnur, H. J., State, R., & Festor, O. (2010) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2010.1012.0352 · Cited by 20 · see citing works
Automatic Application Signature Construction from Unknown Traffic
Wang, Y., Xiang, Y., & Yu, S. (2010) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2010.120 · Cited by 20 · see citing works
Supervised Learning Real-time Traffic Classifiers
Wang, Y., & Yu, S. (2009) · Journal of Networks · doi:10.4304/jnw.4.7.622-629 · Cited by 18 · see citing works
Machine Learning and Its Applicability in Networking
Jain, A., & Nayyar, A. (2020) · Apple Academic Press eBooks · doi:10.1201/9781003007210-3 · Cited by 17 · see citing works
Identify P2P Traffic by Inspecting Data Transfer Behaviour
Ye, M., Wu, J., Xu, K., & Chiu, D. M. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01399-7_11 · Cited by 16 · see citing works
Fine-grained dissection of WeChat in cellular networks
Huang, Q., Lee, P. P. C., He, C., Qian, J., & He, C. (2015) · International Workshop on Quality of Service · doi:10.1109/iwqos.2015.7404750 · Cited by 16 · see citing works
Efficient sequence alignment of network traffic
Kreibich, C., & Crowcroft, J. (2006) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1177080.1177121 · Cited by 16 · see citing works
Self-citationRethinking robust and accurate application protocol identification
Wang, Y., Yun, X., Zhang, Y., Chen, L., & Zang, T. (2017) · Computer Networks · doi:10.1016/j.comnet.2017.09.006 · Cited by 16 · see citing works
Semi-supervised and Compound Classification of Network Traffic
Zhang, J., Chen, C., Xiang, Y., & Zhou, W. (2012) · IEEE International Conference on Distributed Computing Systems Workshops (ICDCSW) · doi:10.1109/icdcsw.2012.12 · Cited by 16 · see citing works
Using Segment-Based Alignment to Extract Packet Structures from Network Traces
Esoul, O., & Walkinshaw, N. (2017) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs.2017.49 · Cited by 16 · see citing works
Internet Traffic Classification Using Machine Learning: A Token-based Approach
Wang, Y., Xiang, Y., & Yu, S. (2011) · 2011 14th IEEE International Conference on Computational Science and Engineering · doi:10.1109/cse.2011.58 · Cited by 15 · see citing works
Automatic protocol signature generation framework for deep packet inspection
Szabo, G. Z. (2011) · Graduate School and Research Center in Digital Science (EURECOM) · Cited by 15 · see citing works
Caballero, J., & Song, D. X. (2018) · Figshare · doi:10.1184/r1/6468026 · Cited by 15 · see citing works
Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach
Wang, Y., Yun, X., & Zhang, Y. (2015) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2015.43 · Cited by 15 · see citing works
On Metrics to Distinguish Skype flows from HTTP traffic
Freire, E. P., Ziviani, A., & Salles, R. M. (2007) · Latin American Network Operations and Management Symposium · doi:10.1109/lanoms.2007.4362460 · Cited by 15 · see citing works
A Survey on SDN and SDCN Traffic Measurement: Existing Approaches and Research Challenges
Islam, M. S., Al-Mukhtar, M., Khan, M. R. K., & Hossain, M. (2023) · Eng—Advances in Engineering · doi:10.3390/eng4020063 · Cited by 16 · see citing works
Retracted: Traffic identification and traffic analysis based on support vector machine
Wang, Z., Jianguo, W., Yang, S., & Gao, J. (2019) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.5292 · Cited by 14 · see citing works
RetractedExtracting Sent Message Formats from Executables Using Backward Slicing
Liu, M., Jia, C., Liu, L., & Wang, Z. (2013) · International Conference on Emerging Intelligent Data and Web Technologies · doi:10.1109/eidwt.2013.71 · Cited by 14 · see citing works
A Feasible and Explainable Network Traffic Classifier Utilizing DistilBERT
Shin, C.-Y., Park, J.-T., Baek, U.-J., & Kim, M. (2023) · IEEE Access · doi:10.1109/access.2023.3293105 · Cited by 14 · see citing works
Efficient Methods for Early Protocol Identification
Hullár, B., Laki, S., & György, A. (2014) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2014.2358832 · Cited by 13 · see citing works
- Authors
- Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M.
- Affiliations
- University of California San Diego (US)
- University of Cambridge (GB)
- Venue
- Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2006-10-25
- Pages
- 313-326
- OpenAlex
- W2148346742
- Cited by
- 204
- References
- 22
- Citations by year
- 2026: 1 · 2025: 1 · 2023: 4 · 2022: 9 · 2021: 5 · 2020: 11 · 2019: 4 · 2018: 7 · 2017: 10 · 2016: 6 · 2015: 12 · 2014: 12 · 2013: 16 · 2012: 17
- FWCI
- 11.50
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Keywords
- network traffic classification, structural-content model, port mapping, tunneling, network management, traffic traces
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
