Squeezing the Most out of Traffic Classification

Accurate classification of traffic flows is an essential step for administrators to detect intrusion or malicious attacks, forbidden applications, or simply new applications which may impact the future provisioning of network resources. In this work four major topics are considered in connection with traffic classification activities. First, a novel validation method is proposed for characterizing the accuracy and completeness of traffic classification algorithms. The main advantages of the new method are that it is based on realistic traffic mixtures, and it enables a highly automated and reliable validation of traffic classification. The validation method is used to create reference traces and the classification performance of the existing traffic classification methods is measured. Using this information a combined traffic classification method that includes the advantages of different approaches is introduced, in order to provide a high level of classification completeness and accuracy. The second part of our work focuses on gaming traffic. Gaming traffic depends on two main factors, the game protocol and the gamers’ behavior. By understanding the nature of the impact of the later one user behavior detection algorithms are introduced to grab specific events and states from passive traffic measurements. The algorithms focus on the characteristics of the traffic rate, showing what information can be gathered by observing only packet header information. In the third part of our work, a novel model and an algorithm are introduced to extend the Deep Packet Inspection traffic classification method with the analysis of non-fix byte signatures, which are not considered in current methods. Finally, we focus on the performance of traffic classification methods in terms of speed. To support high speed traffic classification the majority of the tasks are reformulated as parallel algorithms and pushed to the Graphical Processing Unit to offload the CPU, which then may serve other processing intensive tasks, e.g., traffic capture. The performance tests of the proposed methods showed that traffic classification is possible up to approximately 6 Gbps with a commodity PC.