Traffic Classification Method Based On Data Stream Fingerprint

Transcription

1 5th nternatonal Conference on Advanced Materals and Comuter Scence (CAMCS 6) Traffc Classfcaton Method Based On Data Stream Fngerrnt Kefe Cheng, a, Guohu We,b and Xangjun Ma3,c College of Comuter Scence Chongqng Unversty of Posts and Telecommuncaton Chongqng, Chna College of Comuter Scence Chongqng Unversty of Posts and Telecommuncaton Chongqng, Chna 3 Chongqng Muncal Publc Securty Bureau Network Securty Cors Chongqng,Chna a chengkf@cqut.edu.cn, b539376@qq.com Keywords: Traffc classfcaton, Reny cross entroy, Data stream fngerrnt, Smlarty Abstract. Traffc classfcaton s a method for categorzng the comuter network traffc nto a number of traffc class based on varous features observed assvely from the traffc. n recent years, duo to the rad develoment of the nternet, as well as the rad ncrease of dfferent nternet alcaton, the requrement to dstngush between the dfferent alcatons s rsng. Many tradtonal methods lke ort based, ackets based and some alternate methods based on machne learnng aroaches have been used for the traffc classfcaton. n ths aer, a new traffc classfcaton method was roosed to utlze the data stream fngerrnt nformaton generated by an alcaton. The roosed new method s comared wth other network traffc classfcaton methods. The exermental results show that the classfcaton accuracy of the new method meet the actual needs. ntroducton n recent years, more and more new network alcatons aear, esecally n moble nternet area. n order to use the bandwdth effectvely and rovde better network servce, the traffc should be classfed accordng to the dfference of nternet alcaton. Tradtonal network classfcaton method based on ort, or the ayload for tradtonal web alcatons erforms well. However, wth the aearance of large numbers of new network alcatons, the accuracy of classfcaton for the tradtonal networks s lower and lower. n ths aer, a traffc classfcaton method based on data stream fngerrnt s ntroduced to mrove the classfcaton accuracy.. Related Work At resent, the manly used method for network traffc classfcaton are: P traffc classfcaton based on ort, P traffc classfcaton based on ayload, traffc classfcaton based on host behavor, P traffc classfcaton based on machne learnng.. Port based P traffc classfcaton Tradtonal classfcaton methods dentfy dfferent tyes of alcatons accordng to the well-known ort numbers(ana desgnated ort number). However, ths aroach has ts lmtatons, some alcatons may not have ther orts regstered wth ANA(for examle, eer to eer alcatons such as Naster and Kazaa). An alcaton may use some ordnary orts other than well-known orts to avod access control restrctons of oeratng system. Although ort-based traffc classfcaton s the fastest and smlest method, several studes have shown that t erforms oorly, less than 7% accuracy n classfyng flows[] [].. Payload based P traffc classfcaton Classfcaton method based on the ayload s known as examnng whether the ayload contans secal label for traffc classfcaton. Ths method s usually used for PP traffc detecton and network ntruson detecton. But ths method also has some defects: frstly, t can only classfy the 6. The authors - Publshed by Atlants Press 74

2 unencryted traffc, and has no effect on encryted traffc or rvate agreement. Secondly, the analyss of content on the alcaton layer drectly leads to the ssues of rvacy nfrngement..3 Traffc classfcaton based on host behavor Another new knd of method s based on the atterns of host behavor at the transort layer [3]. t ays attenton to all the traffc generated by a secfed host, and can accurately assocate each host wth the servces t rovdes or uses. Authors n [4] nvestgated some fundamental characterstcs of network alcatons, such as the huge network dameter and the resence of many hosts actng as both servers and clents, to classfy the network traffc. However, ths method s tme-consumng and cannot classfy a sngle flow, snce t must gather nformaton from server flows of each host before t can dentfy the role of a host..4 Traffc classfcaton based on machne learnng Wth the ncreasng demand of network classfcaton, newer methods relyng on traffc statstcal characterstcs was used to dentfy the alcaton [5][6]. Ths methods frstly assume that traffc generated by some knd of alcatons has some unque features. However, due to the need for large-scale data sets for statstcs, a traffc classfcaton method based on machne learnng s roosed n lterature [7]. n many cases they could be hardly used for real-tme network traffc classfcaton due to the comlexty of machne learnng algorthms [8][9]. 3. Methodology Ths aer sums u the advantages and dsadvantages of the current network traffc classfcaton methods, a new traffc classfcaton method based on data stream fngerrnt s roosed. The framework of the roosed method s descrbed n Fg., whch can be dvded nto mult-stes as follows: Ste : Collectng data acket and then constructng the sesson flow. Ste : Extractng the data stream fngerrnts n the sesson flow, and determnng whether the current rocess s n the learnng hase. f so, uttng the data stream fngerrnt nto the samle data stream fngerrnt database, then endng rocess. f not, go to the next ste. Ste 3: Calculatng the data stream fngerrnt dstrbuton robablty of the current ackets. Calculatng the smlarty between the current data stream dstrbuton robablty and the samle data stream fngerrnt n the database, and obtanng the fnal results. Fg. Framework of the roosed method 3. Pre-rocessng Pre-rocessng s manly used to collect the network ackets, and then usng the nsecton acket header nformaton to construct the sesson flow. A flow can be defne as successve P ackets havng the same 5-tule: source P, destnaton P, source ort, destnaton ort, and transort layer rotocol. 743

3 3. The data stream fngerrnt n ths aer, we use a set of ostve ntegers between and 55 to descrbe the ayload of a acket, whch can be exressed n Eq.(), where the varable Payload refers to the ayload data, [,,,, 55] s the element that s comosed of the varable Payload. We obtan the X robablty dstrbuton by accountng the number of X from the Payload. n ths aer, the robablty dstrbuton of X s called as Data Stream Fngerrnt (DSF). The DSF of a acket can be exressed n Eq.(), where = (,,,,,, ) s the robablty dstrbuton of the varable X. { 55} X Payload = 55 () DSF = X = X X X X X 55 () Smlarty of data stream fngerrnt n order to classfy the current network traffc, we need to comare the smlarty between current data stream fngerrnt and the tranng samle data stream fngerrnt. We use orders Reny cross entroy to comare the smlarty. orders Reny cross entroy s defned as Eq.(3):, = log q ( (3) Where and q are two dscrete stochastc varables, r and q r are the robablty functon of, q. One mortant roerty of Reny cross entroy s that f the dscrete stochastc varables have the same dstrbuton, then. Then the entroy measure n Eq.(3) s asymmetrc, whch means that (, ( q, ). But n our method, the symmetrc of Eq.(3) s sutable for the smlarty of data stream fngerrnt. So when chose =. 5, the Reny cross entroy can be rewrtten nto Eq.(4)..5, = log q ( (4) Method based on the Reny cross entroy to classfy a secfc traffc can be exressed as follow: N S = (, =.5 log = (,,,,, q = ( q,,,,, ) q q q N N = 55 N ) q (5) Where s one of the data stream fngerrnt samles n the database whle q s the data stream fngerrnt of the traffc whch wll be classfed. We can know from Eq.(5), f the and q have the same or smlarty data stream fngerrnt dstrbutons, the Reny cross entroy S wll be equal or close to. When the data stream fngerrnt dstrbutons of and q have the larger dfference, then 744

4 the Reny cross entroy S s farther from. So, we need to set a sutable threshold β. When S s classfed nto. β, q 4. Exerment 4.Exermental envronment The exermental envronment s owerful comuter confgured wth 4 ntel Core 5-4U and 4G RAM. n ths aer, we develoed a frontend module and a backend module based on the Lnux latform to mlement the traffc classfcaton method based on the data stream fngerrnt. The frontend module s used to extracted the data stream fngerrnt of network ackets. Whle the backend module s used to calculate the smlarty of data stream fngerrnt and rocess the result of classfcaton. Whle mlementng the traffc classfcaton exerment, frstly we let the frontend module and backend module to enter the learnng hase. n ths aer, the learnng hase tme s set to mnutes. At the same tme, the collected data durng the learnng hase s used as a tranng samle set. The set conssts of 45 data stream fngerrnts such as dns, ft, htt, htts, smt. 4.Performance Evaluaton When the learnng hase comleted, the two modules wll come to the testng hase. Ths hase s manly used to measure the smlarty between the data stream fngerrnt of the current ackets and the tranng samle set. n ths aer, the threshold of fngerrnt smlarty s selected as.. For the exermental uroses, the roosed new method s comared wth other methods lke Nave Bayes and Suort Vector Machne. The exermental results are shown n the Table. Table : Performance evaluaton Usng Memory Classfcaton Method Accuracy (%) Error (%) Tme (sec) (MB) Data Stream Fngerrnt Naïve Bayes Suort Vector Machne Results show that the roosed new traffc classfcaton method s lower than the other two methods n classfcaton accuracy. n the lterature [], the accuracy of the currently avalable network traffc classfcaton methods s from 88% to %, so the roosed method can be used n real alcaton. The accuracy of the roosed new method s low manly due to the followng two asects: Due to the roosed new traffc classfcaton method s manly aled to the classfcaton of network traffc n ublc laces, t s requred that the new method s able to real-tme classfcaton of the network traffc. So n the case where the accuracy of the classfcaton results meet avalable, we are more concerned about the tme consumton of the classfcaton rocess. n ths aer, the frontend module only extracts the data stream fngerrnt of the frst 5 ackets n a sesson flow. Ths results n some cases, the extracted data stream fngerrnt could not comletely reflect the fngerrnt feature of an entre sesson flow, and then decreases the classfcaton accuracy. 5. Concluson n ths aer, we roose a new traffc classfcaton method based on data stream fngerrnt of the ackets n a sesson flow. n the exermental stage, we only extract the data stream fngerrnt of the frst 5 ackets n a sesson flow as features to classfy network traffc. Ths results n a declne of the classfcaton accuracy. However, the exermental results show that the roosed method has the classfcaton accuracy above 9%. The testng results also verfy that the roosed method can 745

5 used for the traffc classfcaton. n future works, we wll collect the ackets n the network by usng the Posson samlng method. n ths way, the data stream fngerrnt characterstcs of the samled ackets can reflect the data stream fngerrnt characterstcs of an entre sesson flow. Then the classfcaton accuracy of our roosed new traffc method wll be further mroved. Acknowledgment The research resented n ths aer s suorted n art by the Scence and Technology Research Project of Chongqng Educaton Commttee(KJ444), the Technology Suort Demonstraton Project of Chongqng Educaton Cloud(cstcjcsf-jfzhX). References [] Erman J, Mahant A, Arltt M. Byte me: a case for byte accuracy n traffc classfcaton[c]//proceedngs of the 3rd annual ACM worksho on Mnng network data. ACM, 7: [] Moore A W, Paagannak K. Toward the accurate dentfcaton of network alcatons[m]//passve and Actve Network Measurement. Srnger Berln Hedelberg, 5: [3] Mega J, Murata Y, Hrasawa M, et al. Usng host roflng to refne statstcal alcaton dentfcaton[c]// NFOCOM, Proceedngs EEE. EEE, : [4] Constantnou F, Mavrommats P. dentfyng Known and Unknown Peer-to-Peer Traffc[C]// Network Comutng and Alcatons, 6. NCA 6. Ffth EEE nternatonal Symosum on. EEE, 6:93-. [5] Crott M, Dus M, Grngol F, et al. Traffc classfcaton through smle statstcal fngerrntng[j]. ACM SGCOMM Comuter Communcaton Revew, 7, 37(): 5-6. [6] Auld T, Moore A W, Gull S F. Bayesan neural networks for nternet traffc classfcaton[j]. Neural Networks, EEE Transactons on, 7, 8(): [7] Nguyen T T T, Armtage G. A survey of technques for nternet traffc classfcaton usng machne learnng[j]. Communcatons Surveys & Tutorals, EEE, 8, (4): [8] Taasw S, Guta A S. Flow-Based PP Network Traffc Classfcaton Usng Machne Learnng[C]// Cyber-Enabled Dstrbuted Comutng and Knowledge Dscovery (CyberC), 3 nternatonal Conference on. EEE, 3:4-46. [9] Elnaka A M, Mahmoud Q H. Real-tme traffc classfcaton for unfed communcaton networks[c]// Moble and Wreless Networkng (MoWNeT), 3 nternatonal Conference on Selected Tocs n. 3:-6. [] Donato W, Pescaé A, Danott A. Traffc dentfcaton engne: an oen latform for traffc classfcaton[j]. Network, EEE, 4, 8():