Network Traffic Classification by Program Synthesis

Abstract Writing classification rules to identify interesting network traffic is a time-consuming and error-prone task. Learning-based systems automatically extract such from positive negative examples. However, due limitations in the representation of learning strategy, these lack both expressiveness cover range applications interpretability fully describing traffic’s structure at session layer. This paper presents Sharingan system, which uses program synthesis techniques generate programs accepts raw traces as inputs reports potential patterns target NetQRE, domain specific language designed for specifying session-layer quantitative properties. We develop novel optimizations that reduce time large complex tasks matter minutes. Our experiments show able correctly diverse set generates explainable outputs, while achieving accuracy comparable state-of-the-art learning-based systems.