Abstract
This paper proposes KISS, a new Internet classification method. Motivated by the expected raise of UDP traffic volume, which stems from the momentum of P2P streaming applications, we propose a novel statistical payload-based classification framework, targeted to UDP traffic.
Statistical signatures are automatically inferred from training data, by the means of a Chi-Square like test, which extracts the protocol “syntax”, but ignores the protocol semantic and synchronization rules. The signatures feed a decision engine based on Support Vector Machines. KISS is tested in different scenarios, considering both data, VoIP, and traditional P2P Internet applications. Results are astonishing. The average True Positive percentage is 99.6%, with the worst case equal 98.7%. Less than 0.05% of False Positives are detected.
This work was funded by the European Commission under the 7th Framework Programme Strep Project “NAPA-WINE” (Network Aware Peer-to-Peer Application over Wise Network)
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Karagiannis, T., Broido, A., Brownlee, N., Claffy, K.C., Faloutsos, M.: Is P2P dying or just hiding? In: IEEE GLOBECOM 2004, November 2004, vol. 3, pp. 1532–1538 (2004)
Bonfiglio, D., Mellia, M., Meo, M., Rossi, D., Tofanelli, P.: Revealing Skype Traffic: when Randomness Plays with You. In: ACM SIGCOMM, Kyoto, JP (August 2007)
Karagiannis, T., Papagiannaki, K., Faloutsos, M.: BLINC: multilevel traffic classification in the dark. ACM SIGCOMM Computer Communication Review 35(4) (2005)
Moore, A.W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. In: ACM SIGMETRICS, Banff, Canada, June 2005, pp. 50–60 (2005)
Cristianini, N., Shawe-Taylor, J.: An introduction to support Vector Machines and other kernel-based learning methods. Cambridge University Press, New York (1999)
Wang, R., Liu, Y., Yang, Y., Zhou, X.: Solving the App-Level Classification Problem of P2P Traffic Via Optimized Support Vector Machines. In: Proc. of ISDA 2006 (October 2006)
Leonardi, E., Mellia, M., Horvart, A., Muscariello, L., Niccolini, S., Rossi, D.: Building a Cooperative P2P-TV Application over a Wise Network: the Approach of the European FP-7 STREP NAPA-WINE. IEEE Communications Magazine 46, 20–211 (2008)
Mellia, M., Lo Cigno, R., Neri, F.: Measuring IP and TCP behavior on edge nodes with Tstat. Computer Networks 47(1), 1–21 (2005)
Birke, R., Mellia, M., Petracca, M., Rossi, D.: Understanding VoIP from Backbone Measurements. In: IEEE INFOCOM 2007, Anchorage, Ak (May 2007)
IPP2P home page, http://www.ipp2p.org/
Kulbak, Y., Bickson, D.: The eMule protocol specification, Technical Report Leibniz Center TR-2005-03, School of Computer Science and Engineering, The Hebrew University (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Finamore, A., Mellia, M., Meo, M., Rossi, D. (2009). KISS: Stochastic Packet Inspection. In: Papadopouli, M., Owezarski, P., Pras, A. (eds) Traffic Monitoring and Analysis. TMA 2009. Lecture Notes in Computer Science, vol 5537. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-01645-5_14
Download citation
DOI: https://doi.org/10.1007/978-3-642-01645-5_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-01644-8
Online ISBN: 978-3-642-01645-5
eBook Packages: Computer ScienceComputer Science (R0)