ACAS: Automated construction of application signatures

DMCA

ACAS: Automated construction of application signatures (2005)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Patrick Haffner , Subhabrata Sen , Oliver Spatscheck , Dongmei Wang

Venue:	In SIGCOMM’05 MineNet Workshop
Citations:	91 - 1 self

BibTeX

@INPROCEEDINGS{Haffner05acas:automated,
    author = {Patrick Haffner and Subhabrata Sen and Oliver Spatscheck and Dongmei Wang},
    title = {ACAS: Automated construction of application signatures},
    booktitle = {In SIGCOMM’05 MineNet Workshop},
    year = {2005}
}

OpenURL

Abstract

An accurate mapping of traffic to applications is important for a broad range of network management and measurement tasks. Internet applications have traditionally been identified using well-known default server network-port numbers in the TCP or UDP headers. However this approach has become increasingly inaccurate. An alternate, more accurate technique is to use specific application-level features in the protocol exchange to guide the identification. Unfortunately deriving the signatures manually is very time consuming and difficult. In this paper, we explore automatically extracting application signatures from IP traffic payload content. In particular we apply three statistical machine learning algorithms to automatically identify signatures for a range of applications. The results indicate that this approach is highly accurate and scales to allow online application identification on high speed links. We also discovered that content signatures still work in the presence of encryption. In these cases we were able to derive content signature for unencrypted handshakes negotiating the encryption parameters of a particular connection.

Keyphrases

application signature automated construction content signature broad range internet application network management measurement task protocol exchange accurate technique specific application-level feature ip traffic payload content encryption parameter high speed link online application identification time consuming network-port number particular connection accurate mapping well-known default udp header unencrypted handshake statistical machine

DMCA