DMCA
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
| Citations: | 17 - 4 self |
BibTeX
@MISC{Finamore_kiss:stochastic,
author = {Alessandro Finamore and Marco Mellia and Michela Meo and Dario Rossi},
title = { KISS: Stochastic Packet Inspection Classifier for UDP Traffic},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
This paper proposes KISS, a novel Internet classification engine. Motivated by the expected raise of UDP traffic, which stems from the momentum of P2P streaming applications, we propose a novel classification framework which leverages on statistical characterization of payload. Statistical signatures are derived by the means of a Chi-Square like test, which extracts the protocol “format”, but ignores the protocol “semantic ” and “synchronization ” rules. The signatures feed a decision process based either on the geometric distance among samples, or on Support Vector Machines. KISS is very accurate, and its signatures are intrinsically robust to packet sampling, reordering, and flow asymmetry, so that it can be used on almost any network. KISS is tested in different scenarios, considering traditional client-server protocols, VoIP and both traditional and new P2P Internet applications. Results are astonishing. The average True Positive percentage is 99.6%, with the worst case equal 98.1,% while results are almost perfect when dealing with new P2P streaming applications.
Keyphrases
udp traffic stochastic packet inspection classifier novel classification framework average true positive percentage synchronization rule new p2p streaming application traditional client-server protocol different scenario new p2p internet application flow asymmetry support vector machine statistical characterization decision process expected raise protocol format novel internet classification engine statistical signature geometric distance
