RESO

Optimized Protocols and Software for High-Performance Networks

  • Increase font size
  • Default font size
  • Decrease font size

Gdt le 21/04 à 14h - Mohamad JABER

E-mail Print
Mohamad Jaber, doctorant dans l'équipe INRIA Planète, nous présentera ses travaux de recherche le jeudi 21 avril à 14h en salle du conseil. 

Ci-dessous un résumé de sa présentation.

An iterative approach for the online identification of Internet applications

The evolution of the Internet in the last few years has been characterized by dramatic changes in the way users behave, interact and utilize the network. This was accompanied by the introduction of new categories of applications such as network games and peer-to-peer.
The identification of Internet traffic applications is very important for ISPs and network administrators to protect their resources from unwanted traffic and prioritize some major applications. Statistical methods are preferred to port-based ones and deep packet inspection since they don’t rely on the port number and they also work for encrypted traffic. These methods combine the statistical analysis of the application packet flow parameters, such as packet size and inter-packet time, with machine learning techniques
In the first part of this work we present a new online iterative probabilistic method that identifies applications quickly and accurately by only using the size of packets. Our method associates a configurable confidence level to the port number carried in the transport header and is able to consider a variable number of packets at the beginning of a flow. By verification on real traces we observe that even in the case of no confidence in the port number, a very high accuracy can be obtained for well known applications after few packets were examined.
In the second part of this work we make a complete study about the inter-packet time to prove that it is also valuable information for the classification of Internet traffic. We discuss how to isolate the noise due to the network conditions and extract the time generated by the application. We present a model to preprocess the inter-packet time and use the result as input to the learning process. We discuss the same iterative approach for the online identification of the applications and we evaluate our method on two different real traces. The results show that the inter-packet time is an important parameter to classify Internet traffic.
In the last part of this work we propose a new online method for traffic classification that combines the statistical and host-based approaches in order to construct a robust and precise method for early Internet traffic identification. We use the packet size as the main feature for the classification and we benefit from the traffic profile of the host (i.e. which application and how much) to decide in favor of this or that application. This latter profile is updated online based on the result of the classification of previous flows originated by or addressed to the same host. We evaluate our method on real traces using several applications. The results show that leveraging the traffic pattern of the host ameliorates the performance of statistical methods. They also prove the capacity of our solution to derive profiles for the traffic of Internet hosts and to identify the services they provide
Last Updated on Tuesday, 19 April 2011 12:20