The DOI matches its Crossref record; 20 of the 22 references it cites were found in a registry or an index.
Early application identification
Open accessAbstract
The automatic detection of applications associated with network traffic is an essential step for network security and traffic engineering. Unfortunately, simple port-based classification methods are not always efficient and systematic analysis of packet payloads is too slow. Most recent research proposals use flow statistics to classify traffic flows once they are finished, which limit their applicability for online classification. In this paper, we evaluate the feasibility of application identification at the beginning of a TCP connection. Based on an analysis of packet traces collected on eight different networks, we find that it is possible to distinguish the behavior of an application from the observation of the size and the direction of the first few packets of the TCP connection. We apply three techniques to cluster TCP connections: K-Means, Gaussian Mixture Model and spectral clustering. Resulting clusters are used together with assignment and labeling heuristics to design classifiers. We evaluate these classifiers on different packet traces. Our results show that the first four packets of a TCP connection are sufficient to classify known applications with an accuracy over 90% and to identify new applications as unknown with a probability of 60%.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Nevertheless, various classifiers leverage port numbers in conjunction with other techniques [31,56,244,417] to improve the performance of the traffic classifiers.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [56]
Citations
Cites
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
On Spectral Clustering: Analysis and an algorithm
Ng, A. Y., Jordan, M. I., & Weiss, Y. (2001) · Cited by 8,159
Baum, L. E., Petrie, T., Soules, G., & Weiss, N. (1970) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177697196 · Cited by 4,299
A fast string searching algorithm
Boyer, R. S., & Moore, J. S. (1977) · Communications of the ACM · doi:10.1145/359842.359859 · Cited by 2,312
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585
Self-citationThe changing usage of a mature campus-wide wireless network
Henderson, T., Kotz, D. F., & Abyzov, I. (2004) · Proceedings of the 28th Annual International Conference on Mobile Computing And Networking · doi:10.1145/1023720.1023739 · Cited by 570
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521
Cited by
Sorted by citations
Items 301–375 of 375
A Unified Framework for Flow Classification
Anantavrasilp, I. (2009) · International Conference on Signal Processing Systems (ICSPS) · doi:10.1109/icsps.2009.97 · Cited by 2
Network Traffic Characterization Using (p,n)-grams Packet Representation
Hijazi, A. (2014) · doi:10.22215/etd/2014-10109 · Cited by 2
Byte Segmented Convolutional Neural Network for Network Traffic Classification
Pepsi, M. B. B., Aruna, M., Deepika, J., & SoundharyaGomathi, S. (2023) · International Conference on Optimization Techniques for Learning (ICOTL) · doi:10.1109/icotl59758.2023.10434992 · Cited by 1
Early Attack Identification in the Wild
Kim, M., Lee, D., Lee, K., Kim, D., Kim, J., Lee, S., & Kim, J. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3677135 · Cited by 1
KISSS: Stochastic Packet Inspection for UDP Traffic Classification
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2009) · PORTO@Iris · Cited by 1
A Fast FPGA-Based Classification of Application Protocols Optimized Using Cartesian GP
Grochol, D., Sekanina, L., Žádník, M., & Kořenek, J. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-16549-3_6 · Cited by 1
Lee, S.-K., An, H.-M., & Kim, M. (2014) · 한국통신학회논문지 · doi:10.7840/kics.2014.39b.6.350 · Cited by 1
P2P Streaming Traffic Detection in Encrypted Tunnel
Tseng, C.-M., Chao, L.-Y., & Liu, T.-J. (2013) · International Symposium on Computing and Networking · doi:10.1109/candar.2013.37 · Cited by 1
Novelty P2P Flow Analysis System
Wang, Q., Dai, X., & Huang, L. (2011) · International Conference on Wireless Communications, Networking and Mobile Computing · doi:10.1109/wicom.2011.6040154 · Cited by 1
Network protocol identification ensemble with EA optimization
Goss, R., & Nitschke, G. (2013) · Genetic and Evolutionary Computation Conference Companion (GECCO Companion) · doi:10.1145/2464576.2480783 · Cited by 1
FPGA targeted implementation of a neurofuzzy system for real time TCP/IP traffic classification
Cinti, A., & Rizzi, A. (2013) · International Conference on Advanced Computational Intelligence (ICACI) · doi:10.1109/icaci.2013.6748522 · Cited by 1
Toward systematic methods comparison in traffic classification
Pietrzyk, M., Janowski, L., & Urvoy-Keller, G. (2011) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2011.5982681 · Cited by 1
An Omnibus Identification of BitTorrent Traffic in a Stub Network
Yang, Z., Li, L., Ji, Q., & Zhu, Y. (2010) · International Symposium on Parallel Architectures, Algorithms and Programming · doi:10.1109/paap.2010.47 · Cited by 1
Baiocchi, A., Maiolini, G., Molina, G., & Rizzi, A. (2008) · Advances in soft computing · doi:10.1007/978-3-540-88181-0_23 · Cited by 1
Training traffic classifiers with arbitrary packet sets
Wang, R., Shi, L., & Jennings, B. (2013) · IEEE International Conference on Communications workshops · doi:10.1109/iccw.2013.6649440 · Cited by 1
OpenVPN Traffic Identification Using Traffic Fingerprints and Statistical Characteristics
Pang, Y., Jin, S., Li, S., Li, J., & Ren, H. (2013) · Communications in computer and information science · doi:10.1007/978-3-642-35795-4_56 · Cited by 1
Application feature extraction by using both dynamic binary tracking and statistical learning
Lu, G., Du, J., Guo, R., Zhou, Y. L., & Fu, H. (2017) · IEEE International Conference on Communication Technology (ICCT) · doi:10.1109/icct.2017.8359983 · Cited by 1
Impact of Early Estimation of Statistical Flow Features in On-line P2P Classification
Abdalla, B. M. A., Hamdan, M., Khalifa, E. H., Abdallah, A. E., Ismail, I., & Marsono, M. N. (2020) · IEEE Student Conference on Research and Development (SCOReD) · doi:10.1109/scored50371.2020.9250967 · Cited by 1
Liu, Z., Xie, Y., Ding, X., & Xu, Y. (2023) · International Conference on Cloud Computing, Data Science & Engineering (Confluence) · doi:10.1109/confluence56041.2023.10048831 · Cited by 1
TCP-Verkehrsklassifizierung mit Markov-Modellen
Münz, G., Braun, L., Dai, H., & Carle, G. (2010) · PIK - Praxis der Informationsverarbeitung und Kommunikation · doi:10.1515/piko.2010.019 · Cited by 1
AN INVESTIGATION OF A MULTI-OBJECTIVE GENETIC ALGORITHM APPLIED TO ENCRYPTED TRAFFIC IDENTIFICATION
Bacquet, C. (2010) · Library and Archives Canada (Government of Canada) · Cited by 1
Johansson, D. (2009) · Diva portal (Dalarna University Library) · Cited by 1
Application of advanced machine learning techniques to early network traffic classification
Gómez, S. E. (2020) · doi:10.35376/10324/43197 · Cited by 1
Cao, H. (2008) · KTH Publication Database DiVA (KTH Royal Institute of Technology) · Cited by 1
Multiscale Internet Statistics: Unveiling the Hidden Behavior
Salvador, P., Nogueira, A., & Rocha, E. (2015) · CIM series in mathematical sciences · doi:10.1007/978-3-319-16121-1_15
Modèles probabilistes et statistiques pour la conception et l'analyse des systèmes de communications
Bermolen, P. (2010) · Americanae (AECID Library)
Measurement-driven characterization of emerging trends in Internet content delivery
Guerra, T., & Darío, R. (2011)
Automatic Internet Traffic Classification for Early Application Identification
Verticale, G. (2010) · InTech eBooks · doi:10.5772/8611
Multiple Classifier Systems in Adversarial Environments: "Challenges and Solutions"
Gargiulo, F. (2009) · Università degli Studi di Napoli Federico II · doi:10.6092/unina/fedoa/3894
A Hybrid Classifier with a Binning Method for Network Application Identification
Moon, I., Albalawi, U., Kim, J., Suh, S. C., & Lee, W.-H. (2014) · Journal of Integrated Design and Process Science · doi:10.3233/jid-2014-0011
On the Fly Encoded Application Flows Recognition by Relying on Statistical Features of IP Traffic.
Maiolini, G., Baiocchi, A., Rizzi, A., Ferri, S., & Gabbrielli, L. (2009)
An early recognition algorithm for BitTorrent traffic based on improved K-means
Rong, H., Li, M., & Cai, L. (2011) · Journal of Central South University of Technology · doi:10.1007/s11771-011-0943-8
40-Gbps optical backbone network deep packet inspection based on FPGA
Zuo, Y., Huang, Z., & Su, S. (2014) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.2070344
A New Approach to Identify User Authentication Methods toward SSH Dictionary Attack Detection
Satoh, A., Nakamura, Y., & Ikenaga, T. (2015) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2014icp0005
Network traffic classification using a random field model
Shen, G., Niu, Z., & Duan, L. (2013) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.2030954
Early recognition of internet traffic based on signature inspection
Xiaona, N., Guo, Y., Zhang, J., & Wang, C. (2010) · Journal of Electronics (China) · doi:10.1007/s11767-010-0307-2
Exploiting Additional Active Time of WiFi Interface to Reduce Power Consumption of Smartphones
Park, Y. D., Jeong, J.-P., & Suh, Y.-J. (2014) · IEEE Vehicular Technology Conference · doi:10.1109/vtcspring.2014.7022922
Application classification in cellular backhaul networks
Nossenson, R., Lior, A., & Brener, K. (2011) · The ... IEEE International Conference on Networks/The IEEE International Conference on Networks · doi:10.1109/icon.2011.6168478
EPFIA: Extensible P2P Flows Identification Architecture
Xu, B., Li, B., Hu, C., & Zhang, G. (2013) · Journal of Applied Mathematics and Physics · doi:10.4236/jamp.2013.14011
AtoZ: an automatic traffic organizer using NetFPGA
Canini, M., Li, W., Žádník, M., & Moore, A. W. (2021) · doi:10.48456/tr-750
Londoño, J., Azer Bestavros, C., & Nikolaos Laoutaris, B. (2011) · Computer Networks · doi:10.1016/j.comnet.2011.05.019
FINGERPRINTING MALICIOUS IP TRAFFIC
Lakhdari, N.-E. (2014) · Spectrum Research Repository (Concordia University)
An Online Classification Approach Based on Universal Inter-arrival Time
Hong, M., Gu, R., Wang, H., & Ji, Y. (2008) · International Conference on Semantics, Knowledge and Grid (SKG) · doi:10.1109/skg.2008.53
Classifying internet applications on early stage in 3G environment
Quan, T., Lee, S., & Won, Y. (2009) · IEEE International Conference on Network Infrastructure and Digital Content (IC-NIDC) · doi:10.1109/icnidc.2009.5360910
An early Intelligent P2P Traffic Identification Method
Peng, J. F., Tu, X. Y., Wang, H. B., & Zhou, Y. J. (2013) · Applied Mechanics and Materials · doi:10.4028/www.scientific.net/amm.321-324.2812
트래픽 수집지점에서 발생하는 TCP패킷중복 및 역전문제 해결 방법
이수강, 안현민, & 김명섭 (2014) · 한국통신학회논문지
Clasificación de flujos en 10 Gbps Ethernet mediante Intel DPDK y GPUS
Leira, R. (2013) · Hispana
Stability of flow features for the identification of Internet applications
Oliveira, M. R., Valadas, R., Pietrzyk, M., & Collange, D. (2014) · International Telecommunications Network Strategy and Planning Symposium · doi:10.1109/netwks.2014.6959223
Hong, H. K., Jo, Y. C., Choi, Y. S., Kim, B. J., & Park, H.-D. (2009) · doi:10.5281/zenodo.1055598
Intelligent IP Traffic / Flow Classification System.
Anantavrasilp, I. (2010) · INC
MACHINE LEARNING BASED NETWORK TRAFFIC CLASSIFICATION INCLUDING ZERO DAY TRAFFIC AS A CLASS.
Yalawar, U., & Kameswari, K. K. (2016) · International Journal of Advanced Research · doi:10.21474/ijar01/542
Zhuo, Z., Zhang, X., Li, R., Chen, T., & Zhang, J. (2016) · Security and Communication Networks · doi:10.1002/sec.1524
User-Centric Traffic Engineering in Software Defined Networks
Bakhshi, T. (2017) · PEARL (University of Plymouth) · doi:10.24382/570
Using of Flow Statistics for Improvement of Protocol Detection
Piskač, P., & Novotný, J. (2011)
High Performance Computing Techniques for Analyzing Risky Decision Making
Gavirangaswamy, V. B. (2017) · ScholarWorks - WMU (Western Michigan University)
CPU-GPU implementation of ensemble clustering algorithm for increased performance
Gavirangaswamy, V. B., & Gupta, A. K. (2017) · International Conference on Intelligent Communication and Computational Techniques (ICCT) · doi:10.1109/intelcct.2017.8324057
Combining Case-Based Reasoning with Complex Event Processing for Network Traffic Classification
Grob, M., Kappes, M., & Medina‐Bulo, I. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01081-2_8
Improving signature quality for network application identification
Tharp, J., Suh, S. C., Cho, H., & Kim, J. (2018) · Digital Communications and Networks · doi:10.1016/j.dcan.2018.10.010
Early Identification of Peer-To-Peer Traffic
Sztaki, M. (2011)
Topic-model based Automatic Signature Extraction of Internet Applications
윤효진 (2013) · Seoul National University Open Repository (Seoul National University)
Traffic Monitoring and Analysis
Hutchison, D., Sudan, M., Rangan, C. P., Steffen, B., Tygar, D., Nierstrasz, O., Naor, M., Terzopoulos, D., Weikum, G., Pras, A., et al. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01645-5
Online Learning for Network Traffic Data Classification
Hsi, W.-C., Wu, C.-H., & Lu, H. H. (2021) · IEEE International Conference on Consumer Electronics - Taiwan (ICCE-Taiwan) · doi:10.1109/icce-tw52618.2021.9602977
Dealing with P2P traffic in modern networks: measurement, identification and control
Valenti, S. (2011) · HAL
(2011) · CRC Press eBooks · doi:10.1201/b11149-32
Glisic, S., & Lorenzo, B. (2022) · Wiley eBooks · doi:10.1002/9781119790327.ch7
Acknowledgments / Remerciements
Paris, E. É. D., Réseaux, S. I. E., Valenti, S., Eurecom, E. B., Brescia, S. U., Olivier, E., Paristech, C. T., Friedman, T., Pierre, U., Curie, M., et al. (1991) · University of Toronto Press eBooks · doi:10.3138/9781442671010-003
Data Volume Reduction for Deep Packet Inspection by Multi-layer Application Determination
Vogel, M., Schuster, F., Kopp, F. M., & König, H. (2022) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr54599.2022.9850293
The Lightweight Botnet Detection Model Based on the Improved UNet
Li, C., Zhang, Y., Li, Z., Feng, F., Liao, Z., & Cui, X. (2023) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-36574-4_14
BANDWIDTH OPTIMIZATION BY TRAFFIC CLASSIFICATION INMULTIMEDIA BROADBAND NETWORKS
N.Akhtar (2023) · Pakistan Journal of Science · doi:10.57041/pjs.v68i3.549
Review and Perspective on Encrypted Traffic Classification Based on Contrastive Learning
Li, Z., Liu, Q., & Yu, K. (2024) · International Conference Civil Engineering and Architecture · doi:10.1109/iccea62105.2024.10604038 · Cited by 1
Non-uniformity is All You Need: Efficient and Timely Encrypted Traffic Classification With ECHO
Daum, S., Shapira, T., Bremler-Barr, A., & Hay, D. (2024) · IEEE International Conference on Network Protocols · doi:10.1109/icnp65844.2025.11192379 · Cited by 4
JITI: Dynamic Model Serving for Just-in-Time Traffic Inference
Jiang, X., Liu, S., Naama, S., Bronzino, F., Schmitt, P., & Feamster, N. (2025) · Proceedings of the ACM on Networking · doi:10.1145/3768992
LoFi: Low-Cost Early Application Filter Based on Cached ML Decisions
Hugon, J., Liu, S., Schmitt, P., Feamster, N., & Bronzino, F. (2026) · IEEE International Conference on Network Softwarization (NetSoft) · doi:10.1109/netsoft70012.2026.11603512
pcapML: Making Network Traffic Datasets Reproducible
Holland, J., Alencaster, J., Feamster, N., & Schmitt, P. (2026) · Applied Networking Research Workshop (ANRW) · doi:10.1145/3822163.3827923
Metadata
- Authors
- Bernaille, L., Teixeira, R., & Salamatian, K.
- Affiliations
- Université Pierre-et-Marie-Curie (FR)
- ORCID
- Teixeira, Renata
- Venue
- Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06
- Publisher
- ACM Press
- Published
- 2006
- Pages
- 1
- OpenAlex
- W2055261595
- Cited by
- 374
- References
- 22
- Citations by year
- 2026: 4 · 2025: 5 · 2024: 9 · 2023: 7 · 2022: 12 · 2021: 14 · 2020: 11 · 2019: 10 · 2018: 16 · 2017: 14 · 2016: 10 · 2015: 19 · 2014: 26 · 2013: 32 · 2012: 23
- FWCI
- 19.89
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) (publishedVersion)
- HAL (submittedVersion, other-oa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- application identification, TCP connections, network traffic classification, online classification, Gaussian mixture model, spectral clustering, K-means clustering, packet traces, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
