• 한국통신학회논문지
• /
• 제33권8B호
• /
• pp.707-718
• /
• 2008

Traffic classification의 방법은 동적으로 변하는 application의 변화에 대처하기 위하여 페이로드나 port를 기반으로 하는 것에서 ML 알고리즘을 기반으로 하는 것으로 변하여 가고 있다. 그러나 현재의 ML 알고리즘을 이용한 traffic classification 연구는 offline 환경에 맞추어 진행되고 있다. 특히, 현재의 기존 연구들은 testing 방법으로 cross validation을 이용하여 traffic classification을 수행하고 있으며, traffic flow를 기반으로 classification 결과를 제시하고 있다. 본 논문에서는 testing방법으로 cross validation과 split validation을 이용했을 때, traffic classification의 정확도 결과를 비교한다. 또한 바이트를 기반으로 한 classification의 결과와 flow를 기반으로 한 classification의 결과를 비교해 본다. 본 논문에서는 J48, REPTree, RBFNetwork, Multilayer perceptron, BayesNet, NaiveBayes와 같은 ML 알고리즘과 다양한 feature set을 이용하여 트래픽을 분류한다. 그리고 split validation을 이용한 traffic classification에 적합한 최적의 ML 알고리즘과 feature set을 제시한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제14권11호
• /
• pp.4246-4267
• /
• 2020

As the network goes deep into all aspects of people's lives, the number and the complexity of network traffic is increasing, and traffic classification becomes more and more important. How to classify them effectively is an important prerequisite for network management and planning, and ensuring network security. With the continuous development of deep learning, more and more traffic classification begins to use it as the main method, which achieves better results than traditional classification methods. In this paper, we provide a comprehensive review of network traffic classification based on deep learning. Firstly, we introduce the research background and progress of network traffic classification. Then, we summarize and compare traffic classification based on deep learning such as stack autoencoder, one-dimensional convolution neural network, two-dimensional convolution neural network, three-dimensional convolution neural network, long short-term memory network and Deep Belief Networks. In addition, we compare traffic classification based on deep learning with other methods such as based on port number, deep packets detection and machine learning. Finally, the future research directions of network traffic classification based on deep learning are prospected.

• ETRI Journal
• /
• 제32권1호
• /
• pp.22-32
• /
• 2010

The pervasive game environments have activated explosive growth of the Internet over recent decades. Thus, understanding Internet traffic characteristics and precise classification have become important issues in network management, resource provisioning, and game application development. Naturally, much attention has been given to analyzing and modeling game traffic. Little research, however, has been undertaken on the classification of game traffic. In this paper, we perform an interpretive traffic analysis of popular game applications at the transport layer and propose a new classification method based on a simple decision tree, called an alternative decision tree (ADT), which utilizes the statistical traffic characteristics of game applications. Experimental results show that ADT precisely classifies game traffic from other application traffic types with limited traffic features and a small number of packets, while maintaining low complexity by utilizing a simple decision tree.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제8권7호
• /
• pp.2261-2280
• /
• 2014

Recently, network traffic has become more complex and diverse due to the emergence of new applications and services. Therefore, the importance of application-level traffic classification is increasing rapidly, and it has become a very popular research area. Although a lot of methods for traffic classification have been introduced in literature, they have some limitations to achieve an acceptable level of performance in real-time application-level traffic classification. In this paper, we propose a novel application-level traffic classification method using payload size sequence (PSS) signature. The proposed method generates unique PSS signatures for each application using packet order, direction and payload size of the first N packets in a flow, and uses them to classify application traffic. The evaluation shows that this method can classify application traffic easily and quickly with high accuracy rates, over 99.97%. Furthermore, the method can also classify application traffic that uses the same application protocol or is encrypted.

• 정보처리학회논문지:컴퓨터 및 통신 시스템
• /
• 제3권2호
• /
• pp.47-56
• /
• 2014

인터넷을 기반으로 하는 다양한 서비스 및 응용의 등장과 무선 디바이스의 보급은 인터넷 트래픽을 급격하게 증가시켰다. 인터넷 트래픽의 급격한 증가로 한정적인 네트워크 자원을 효율적으로 사용하기 위해 인터넷 트래픽 분석의 중요성이 증가하고 있다. 하지만 트래픽 분석 방법론에 비해 분석 결과를 체계적으로 관리하는 분류 체계에 대한 연구는 이루어지지 않고 있다. 본 논문에서는 다각적이고 계층적인 트래픽 분석을 위한 분류 체계를 제안한다. 제안하는 분류 체계는 서비스, 응용, 프로토콜, 기준의 4가지 분류 기준을 사용하여 다각적으로 분석이 가능하며, 분류 기준 별로 계층화된 속성을 가지고 있어 결과의 통합화 및 세분화가 가능하다. 논문에서는 제안한 분류 기준을 실제 학내 망에 적용하여 분석함으로 분류 체계의 장점과 활용성을 보인다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제8권3호
• /
• pp.838-856
• /
• 2014

Enhanced network speed and the appearance of various applications have recently resulted in the rapid increase of Internet users and the explosive growth of network traffic. Under this circumstance, Internet users are eager to receive reliable and Quality of Service (QoS)-guaranteed services. To provide reliable network services, network managers need to perform control measures involving dropping or blocking each traffic type. To manage a traffic type, it is necessary to rapidly measure and correctly analyze Internet traffic as well as classify network traffic according to applications. Such traffic classification result provides basic information for ensuring service-specific QoS. Several traffic classification methodologies have been introduced; however, there has been no favorable method in achieving optimal performance in terms of accuracy, completeness, and applicability in a real network environment. In this paper, we propose a method to classify Internet traffic as the first step to provide stable network services. We integrate the existing methodologies to compensate their weaknesses and to improve the overall accuracy and completeness of the classification. We prioritize the existing methodologies, which complement each other, in our integrated classification system.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제4권5호
• /
• pp.859-876
• /
• 2010

In this paper, we propose a hierarchical application traffic classification system as an alternative means to overcome the limitations of the port number and payload based methodologies, which are traditionally considered traffic classification methods. The proposed system is a new classification model that hierarchically combines a binary classifier SVM and Support Vector Data Descriptions (SVDDs). The proposed system selects an optimal attribute subset from the bi-directional traffic flows generated by our traffic analysis system (KU-MON) that enables real-time collection and analysis of campus traffic. The system is composed of three layers: The first layer is a binary classifier SVM that performs rapid classification between P2P and non-P2P traffic. The second layer classifies P2P traffic into file-sharing, messenger and TV, based on three SVDDs. The third layer performs specialized classification of all individual application traffic types. Since the proposed system enables both coarse- and fine-grained classification, it can guarantee efficient resource management, such as a stable network environment, seamless bandwidth guarantee and appropriate QoS. Moreover, even when a new application emerges, it can be easily adapted for incremental updating and scaling. Only additional training for the new part of the application traffic is needed instead of retraining the entire system. The performance of the proposed system is validated via experiments which confirm that its recall and precision measures are satisfactory.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제3권2호
• /
• pp.134-146
• /
• 2009

Traffic classification seeks to assign packet flows to an appropriate quality of service(QoS) class based on flow statistics without the need to examine packet payloads. Classification proceeds in two steps. Classification rules are first built by analyzing traffic traces, and then the classification rules are evaluated using test data. In this paper, we use self-organizing map and K-means clustering as unsupervised machine learning methods to identify the inherent classes in traffic traces. Three clusters were discovered, corresponding to transactional, bulk data transfer, and interactive applications. The K-nearest neighbor classifier was found to be highly accurate for the traffic data and significantly better compared to a minimum mean distance classifier.

• ETRI Journal
• /
• 제42권3호
• /
• pp.311-323
• /
• 2020

Encrypted traffic classification plays a vital role in cybersecurity as network traffic encryption becomes prevalent. First, we briefly introduce three traffic encryption mechanisms: IPsec, SSL/TLS, and SRTP. After evaluating the performances of support vector machine, random forest, naïve Bayes, and logistic regression for traffic classification, we propose the combined approach of entropy estimation and artificial neural networks. First, network traffic is classified as encrypted or plaintext with entropy estimation. Encrypted traffic is then further classified using neural networks. We propose using traffic packet's sizes, packet's inter-arrival time, and direction as the neural network's input. Our combined approach was evaluated with the dataset obtained from the Canadian Institute for Cybersecurity. Results show an improved precision (from 1 to 7 percentage points), and some application classification metrics improved nearly by 30 percentage points.

• 한국통신학회논문지
• /
• 제36권8B호
• /
• pp.921-928
• /
• 2011

최근 인터넷 사용자의 증가와 다양한 인터넷 기반 응용프로그램의 증가로 네트워크 트래픽이 급증하고 있다. 효율적인 네트워크 트래픽 관리를 위해 기존의 많은 연구들 에서 다양한 분류 알고리즘을 제시하였고, 대부분의 제안된 방법들은 응용 단위로 트래픽을 분류하며 분류의 정확성을 높이는데 초점을 두고 있다. 하지만 트래픽 제어의 관점에서 보았을 때 응용단위의 트래픽 분류는 응용의 기능별 제어의 기회를 제공하지 못하고 네트워크 사용자가 각 응용의 어떤 기능을 사용하는지를 파악하지 못하게 되는 문제점을 가지고 있다 본 논문에서는 이러한 문제점들을 해결 하기 위해 NateOn, MSN, GoogleTalk의 인터넷 메신저 응용에 대하여 기능 오토마타를 설계하고 이를 통해 메신저 응용의 기능별 트래픽 분류를 위한 방법론을 제시한다.