The DOI matches its Crossref record; 22 of the 22 references it cites were found in a registry or an index.
Unexpected means of protocol inference
Abstract
Network managers are inevitably called upon to associate network traffic with particular applications. Indeed, this operation is critical for a wide range of management functions ranging from debugging and security to analytics and policy support. Traditionally, managers have relied on application adherence to a well established global port mapping: Web traffic on port 80, mail traffic on port 25 and so on. However, a range of factors - including firewall port blocking, tunneling, dynamic port allocation, and a bloom of new distributed applications - has weakened the value of this approach. We analyze three alternative mechanisms using statistical and structural content models for automatically identifying traffic that uses the same application-layer protocol, relying solely on flow content. In this manner, known applications may be identified regardless of port number, while traffic from one unknown application will be identified as distinct from another. We evaluate each mechanism's classification performance using real-world traffic traces from multiple sites.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“These models are good at inferring discriminators for binary, textual and structural content [286].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
In the citing paper
“Ma et al. [286] show that payload-based traffic classification can be performed without any a priori knowledge of the application classes using unsupervised clustering.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
In the citing paper
“Furthermore, relying solely on port numbers has been shown to be ineffective [125,228,320], largely due to the use of dynamic port negotiation, tunneling and misuse of port numbers assigned to well-known applications for obfuscating traffic and avoiding firewalls [54,109,176,286].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
In the citing paper
“In evaluation, the PD-based protocol models resulted in the lowest total misclassification error, under 5%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [286]
Citations
Cites
Elements of Information Theory
Cover, T. M., & Thomas, J. A. (2001) · Wiley eBooks · doi:10.1002/0471200611 · Cited by 37,139
Identification of common molecular subsequences
Smith, T. F., & Waterman, M. S. (1981) · Journal of Molecular Biology · doi:10.1016/0022-2836(81)90087-5 · Cited by 9,962
Kademlia: A Peer-to-Peer Information System Based on the XOR Metric
Maymounkov, P., & Mazières, D. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45748-8_5 · Cited by 3,092
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216
A distance measure between attributed relational graphs for pattern recognition
Sanfeliu, A., & Fu, K. (1983) · IEEE Transactions on Systems, Man and Cybernetics · doi:10.1109/tsmc.1983.6313167 · Cited by 1,142
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 811
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801
An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol
Baset, S., & Schulzrinne, H. G. (2006) · doi:10.1109/infocom.2006.312 · Cited by 736
Research works printed but not linked: 3
- 10.5555/129837 · DOI
- 10.5555/646334.687801 · DOI
- G. Voss , A. Schröder , W. Müller-Wittig , and B. Schmidt . Using Graphics Hardware to Accelerate Biological Sequence Analysis . In Proc. of IEEE Tencon , Melbourne, Australia , 2005 . G. Voss, A. Schröder, W. Müller-Wittig, and B. Schmidt. Using Graphics Hardware to Accelerate Biological Sequence Analysis. In Proc. of IEEE Tencon, Melbourne, Australia, 2005.
Cited by
Sorted by citations
Items 201–203 of 203
Moving-Target-Defense based Security Mechanisms: A System Management Perspective
Ravindran, K., Iannelli, M., & Adiththan, A. (2023) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets56262.2023.10041246
Novel anomaly detection and classification algorithms for IP and mobile networks
Blaise, A. (2020) · theses.fr (ABES) · doi:10.70675/d930ba17zd7d9z47ffz92b4zb7d31ec8825e
Network Traffic Classification: A Scientific Contribution Towards Statistical Approaches
Manekar, P., Rajput, K. S., Chandrakant, J. R., & Munot, M. V. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-18211-1_25
Metadata
- Authors
- Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M.
- Affiliations
- University of California San Diego (US)
- University of Cambridge (GB)
- Venue
- Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2006-10-25
- Pages
- 313-326
- OpenAlex
- W2148346742
- Cited by
- 204
- References
- 22
- Citations by year
- 2026: 1 · 2025: 1 · 2023: 4 · 2022: 9 · 2021: 5 · 2020: 11 · 2019: 4 · 2018: 7 · 2017: 10 · 2016: 6 · 2015: 12 · 2014: 12 · 2013: 16 · 2012: 17
- FWCI
- 11.50
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Keywords
- network traffic classification, structural-content model, port mapping, tunneling, network management, traffic traces
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
