Design of DIFFUSE v0.4 – DIstributed Firewall and Flow-shaper Using Statistical Evidence

In recent years a growing number of researchers investigated the performance of machine learning based traffic classification using statistical properties – classification techniques that do not require packet payload inspection. Such techniques assist Internet Service Providers to work within any legal or technical limitations on direct payload inspection. Potential new applications include automated ‘market research’, automated traffic prioritisation, and Lawful Interception. For many of these new applications a de-coupling between the flow classification and subsequent flow treatment, such as blocking or shaping, is highly desirable. We developed DIFFUSE – an extensions for an existing packet filter that provide MLbased traffic classification based on statistical properties and de-couple flow classification from flow treatment. This report describes the selection of the existing packet filter extended, the design of the overall architecture and key components, as well as the machine learning techniques supported. This report is an updated version of tech report 101223A [1].