The DOI matches its Crossref record; 20 of the 22 references it cites were found in a registry or an index.
Early application identification
Open accessAbstract
The automatic detection of applications associated with network traffic is an essential step for network security and traffic engineering. Unfortunately, simple port-based classification methods are not always efficient and systematic analysis of packet payloads is too slow. Most recent research proposals use flow statistics to classify traffic flows once they are finished, which limit their applicability for online classification. In this paper, we evaluate the feasibility of application identification at the beginning of a TCP connection. Based on an analysis of packet traces collected on eight different networks, we find that it is possible to distinguish the behavior of an application from the observation of the size and the direction of the first few packets of the TCP connection. We apply three techniques to cluster TCP connections: K-Means, Gaussian Mixture Model and spectral clustering. Resulting clusters are used together with assignment and labeling heuristics to design classifiers. We evaluate these classifiers on different packet traces. Our results show that the first four packets of a TCP connection are sufficient to classify known applications with an accuracy over 90% and to identify new applications as unknown with a probability of 60%.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Nevertheless, various classifiers leverage port numbers in conjunction with other techniques [31,56,244,417] to improve the performance of the traffic classifiers.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [56]
Citations
Cites
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
On Spectral Clustering: Analysis and an algorithm
Ng, A. Y., Jordan, M. I., & Weiss, Y. (2001) · Cited by 8,159
Baum, L. E., Petrie, T., Soules, G., & Weiss, N. (1970) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177697196 · Cited by 4,299
A fast string searching algorithm
Boyer, R. S., & Moore, J. S. (1977) · Communications of the ACM · doi:10.1145/359842.359859 · Cited by 2,312
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585
Self-citationThe changing usage of a mature campus-wide wireless network
Henderson, T., Kotz, D. F., & Abyzov, I. (2004) · Proceedings of the 28th Annual International Conference on Mobile Computing And Networking · doi:10.1145/1023720.1023739 · Cited by 570
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036
Issues and future directions in traffic classification
Dainotti, A., Pescape, A., & Claffy, K. (2012) · IEEE Network · doi:10.1109/mnet.2012.6135854 · Cited by 630
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2899085 · Cited by 525
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396
Metadata
- Authors
- Bernaille, L., Teixeira, R., & Salamatian, K.
- Affiliations
- Université Pierre-et-Marie-Curie (FR)
- ORCID
- Teixeira, Renata
- Venue
- Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06
- Publisher
- ACM Press
- Published
- 2006
- Pages
- 1
- OpenAlex
- W2055261595
- Cited by
- 374
- References
- 22
- Citations by year
- 2026: 4 · 2025: 5 · 2024: 9 · 2023: 7 · 2022: 12 · 2021: 14 · 2020: 11 · 2019: 10 · 2018: 16 · 2017: 14 · 2016: 10 · 2015: 19 · 2014: 26 · 2013: 32 · 2012: 23
- FWCI
- 19.89
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) (publishedVersion)
- HAL (submittedVersion, other-oa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- application identification, TCP connections, network traffic classification, online classification, Gaussian mixture model, spectral clustering, K-means clustering, packet traces, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
