OptiClass: An Optimized Classifier for Application Layer Protocols Using Bit Level Signatures
Abstract
1 Introduction
2 Related Work
2.1 Shallow Packet Inspection-based Methods
2.2 Deep Packet Inspection-based Methods
3 Proposed Method
![](/cms/10.1145/3633777/asset/17b8985f-a313-42ce-b702-da334ec12766/assets/images/medium/tops-2022-12-0237-f01.jpg)
3.1 Training Phase
3.1.1 Traffic Preprocessing.
3.1.2 Bit Signature Generation.
![](/cms/10.1145/3633777/asset/5dd30bee-0d99-4d22-a655-52b1060aedcc/assets/images/medium/tops-2022-12-0237-f02.jpg)
3.1.3 BiTSPLITTER Creation.
![](/cms/10.1145/3633777/asset/bc37208f-7e61-4f4a-88d3-3b9ac198ce18/assets/images/medium/tops-2022-12-0237-algo1.jpg)
![](/cms/10.1145/3633777/asset/2317b82f-b082-4723-92dc-9eb615f3ea7e/assets/images/medium/tops-2022-12-0237-f03.jpg)
3.2 Testing Phase
3.2.1 Flow Classification Module.
![](/cms/10.1145/3633777/asset/e4062e41-cc30-4478-8c40-e4a31905568c/assets/images/medium/tops-2022-12-0237-f04.jpg)
4 Complexity Analysis
Module | Complexity | Explanation |
---|---|---|
Traffic Preprocessing Module | O(\(f \times p\)) | f are the total number of flows and p are the number of packets in a flow. |
Signature Generation | O(f) | f is the total number of flows of an application A. |
BiTSPLITTER Creation | O(m) | m is the number of application signatures to be inserted. |
Flow Classification | O(\(f \times n\)) | n is the number of bits in f test flows. |
![](/cms/10.1145/3633777/asset/51a4648e-a9b6-4827-a19f-60fc74e88739/assets/images/medium/tops-2022-12-0237-algo2.jpg)
5 Experiments and Results
5.1 Dataset Description
Abbreviation | Protocol | Type | Proprietariness |
---|---|---|---|
BACnet | Building Automation and Control network | Binary | ASHRAE |
BitTorrent | Bit torrent protocol | Text | No |
BJNP | Used to communicate with printer | Binary | Canon |
Bootp | Bootstrap protocol | Binary | No |
CUPS | Common Unix Printing System | Text | Apple Inc. |
DNS | Domain Name System | Binary | No |
Dropbox | Dropbox LAN Sync protocol | Text | Dropbox |
GsmIp | GSM over Internet protocol | Text | No |
HTTP | Hyper Text Transfer Protocol | Text | No |
Kerberos | Kerberos protocol | Binary | No |
MWBP | Microsoft Windows Browsing Protocol | Text | Microsoft |
NBNS | NetBIOS Name Service | Binary | No |
NBSS | NetBIOS Session Service | Binary | No |
NTP | Network Time Protocol | Binary | No |
POP | Post Office Protocol | Text | No |
QUIC | Quick UDP Internet Connections | Binary | No |
RPC | Remote Procedure Call | Binary | No |
SIP | Session Initiation Protocol | Text | No |
SMTP | Simple Mail Transfer Protocol | Text | No |
SSH | Secure Shell | Binary | No |
Protocol | TCP/UDP | Training | Testing | ||
---|---|---|---|---|---|
Flows | Size (MB) | Flows | Size (MB) | ||
BitTorrent | TCP | 00789 | 245.8 | 00791 | 150.4 |
DNS | UDP | 32576 | 005.7 | 32762 | 005.7 |
Dropbox | UDP | 01138 | 098.2 | 01128 | 153.4 |
HTTP | TCP | 48834 | 220.4 | 48878 | 328.3 |
SIP | UDP | 00609 | 194.1 | 00640 | 191.4 |
SMTP | TCP | 00597 | 010.1 | 00608 | 022.9 |
SSH | TCP | 01104 | 006.2 | 01106 | 006.2 |
Total | \(-\) | \(\mathbf {85647}\) | \(\mathbf {7 8 0 . 5}\) | \(\mathbf {85913}\) | \(\mathbf {8 5 8 . 3}\) |
Protocol | TCP/UDP | Training | Testing | ||
---|---|---|---|---|---|
Flows | Size (MB) | Flows | Size (MB) | ||
BACnet | UDP | 00009 | 000.097 | 00011 | 000.074 |
BJNP | UDP | 00034 | 000.026 | 00038 | 000.031 |
Bootp | UDP | 00086 | 004.400 | 00081 | 004.500 |
CUPS | UDP | 00047 | 000.107 | 00045 | 000.218 |
DNS | UDP | 25469 | 012.900 | 25850 | 011.100 |
Dropbox | UDP | 00026 | 000.109 | 00025 | 000.319 |
HTTP | TCP | 17964 | 151.100 | 17968 | 133.600 |
MWBP | UDP | 00008 | 000.565 | 00007 | 000.574 |
NBNS | UDP | 00982 | 007.800 | 00982 | 007.500 |
NTP | UDP | 00201 | 000.652 | 00201 | 000.141 |
QUIC | UDP | 00127 | 000.110 | 00093 | 000.115 |
SMTP | TCP | 00520 | 010.100 | 00521 | 009.900 |
Total | \(-\) | \(\mathbf {45473}\) | \(\mathbf {187.996}\) | \(\mathbf {45822}\) | \(\mathbf {168.072}\) |
Protocol | TCP/UDP | Training | Testing | ||
---|---|---|---|---|---|
Flows | Size (MB) | Flows | Size (MB) | ||
Bootp | UDP | 00091 | 00.080 | 00091 | 0.096 |
DNS | UDP | 00963 | 00.865 | 00958 | 1.200 |
Gsmlp | TCP | 00009 | 00.007 | 00009 | 0.015 |
HTTP | TCP | 00257 | 04.800 | 00253 | 9.000 |
Kerberos | UDP | 00669 | 01.600 | 00672 | 1.900 |
NBNS | UDP | 00290 | 00.853 | 00289 | 0.680 |
NBSS | TCP | 00377 | 02.700 | 00373 | 3.900 |
NTP | UDP | 00202 | 00.145 | 00200 | 0.648 |
POP | TCP | 00056 | 00.035 | 00057 | 0.036 |
RPC | TCP | 00007 | 00.020 | 00007 | 0.141 |
Total | \(-\) | \(\mathbf {2921}\) | \(\mathbf {1 1 . 1 0 5}\) | \(\mathbf {2909}\) | \(\mathbf {1 7 . 6 1 6}\) |
5.2 Evaluation
5.2.1 Homogeneous Experiments.
![](/cms/10.1145/3633777/asset/305c1d88-d346-46db-8da4-5a934ccdf3dc/assets/images/medium/tops-2022-12-0237-t06.jpg)
5.2.2 Heterogeneous Experiments.
![](/cms/10.1145/3633777/asset/5fb50ce7-1d13-4a82-8060-9b6afd1276c6/assets/images/medium/tops-2022-12-0237-t07.jpg)
![](/cms/10.1145/3633777/asset/a383058f-ca71-42e9-8679-1d2931869eea/assets/images/medium/tops-2022-12-0237-t08.jpg)
![](/cms/10.1145/3633777/asset/f16c12ca-5c93-4004-9f00-42ecb1691740/assets/images/medium/tops-2022-12-0237-t09.jpg)
5.2.3 Grand Experiment.
Protocol | Grand Dataset | Private Dataset | Public-1 Dataset | Public-2 Dataset | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | |
BACnet | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) |
BJNP | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) |
BitTorrent | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) |
Bootp | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
CUPS | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 095.74 | 097.82 | \(-\) | \(-\) | \(-\) |
DNS | 099.87 | 099.93 | 099.89 | 099.77 | 099.96 | 099.86 | 099.99 | 099.53 | 099.75 | 099.89 | 092.37 | 095.98 |
Dropbox | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) |
GsmIp | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 |
HTTP | 086.48 | 086.74 | 086.60 | 090.95 | 100.00 | 095.26 | 074.30 | 100.00 | 085.25 | 088.53 | 100.00 | 093.91 |
Kerberos | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | 100.00 | 092.68 | 096.20 |
MWBP | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 087.50 | 093.33 | \(-\) | \(-\) | \(-\) |
NBNS | 084.18 | 084.31 | 084.24 | \(-\) | \(-\) | \(-\) | 087.67 | 100.00 | 093.42 | 072.31 | 100.00 | 083.93 |
NBSS | 085.79 | 085.79 | 085.79 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | 085.79 | 100.00 | 092.35 |
NTP | 097.25 | 097.25 | 097.25 | \(-\) | \(-\) | \(-\) | 094.52 | 100.00 | 097.18 | 100.00 | 100.00 | 100.00 |
POP | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 |
QUIC | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | 100.00 | 068.88 | 081.57 | \(-\) | \(-\) | \(-\) |
RPC | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | 100.00 | 100.00 | 100.00 |
SIP | 093.75 | 093.75 | 093.75 | 084.37 | 099.44 | 091.28 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) |
SMTP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) |
SSH | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) | \(-\) |
Protocols | BACnet | BitTorrent | BJNP | Bootp | CUPS | DNS | Dropbox | GsmIpa | HTTP | Kerberos | MWBP | NBNS | NBSS | NTP | POP | QUIC | RPC | SIP | SMTP | SSH |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
(11) | (791) | (38) | (172) | (45) | (59577) | (1153) | (9) | (67099) | (672) | (7) | (1271) | (373) | (401) | (57) | (93) | (7) | (640) | (1129) | (1106) | |
BACnet | 11 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
BitTorrent | 0 | 791 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
BJNP | 0 | 0 | 38 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Bootp | 0 | 0 | 0 | 172 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
CUPS | 0 | 0 | 0 | 0 | 45 | 0 | 0 | 0 | 101 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
DNS | 0 | 0 | 0 | 0 | 0 | 59502 | 0 | 0 | 0 | 0 | 0 | 199 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Dropbox | 0 | 0 | 0 | 0 | 0 | 0 | 1153 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
GsmIpa | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 9 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
HTTP | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 58031 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Kerberos | 0 | 0 | 0 | 0 | 0 | 34 | 0 | 0 | 26 | 672 | 0 | 0 | 53 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
MWBP | 0 | 0 | 0 | 0 | 0 | 2 | 0 | 0 | 4 | 0 | 7 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
NBNS | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 0 | 0 | 1070 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
NBSS | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 320 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
NTP | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 390 | 0 | 0 | 0 | 0 | 0 | 0 |
POP | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 57 | 0 | 0 | 0 | 0 | 0 |
QUIC | 0 | 0 | 0 | 0 | 0 | 38 | 0 | 0 | 8864 | 0 | 0 | 2 | 0 | 11 | 0 | 93 | 0 | 40 | 0 | 0 |
RPC | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 7 | 0 | 0 | 0 |
SIP | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 67 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 600 | 0 | 0 |
SMTP | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1129 | 0 |
SSH | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1106 |
5.3 Sensitivity Analysis
5.3.1 Signature Length.
Protocols | 16 Bits | 32 Bits | 48 Bits | ||||||
---|---|---|---|---|---|---|---|---|---|
Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | |
BACnet | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BJNP | 97.36 | 100.00 | 98.66 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BitTorrent | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
Bootp | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
CUPS | 88.88 | 100.00 | 94.11 | 100.00 | 100.00 | 100.00 | 100.00 | 49.45 | 66.17 |
DNS | 100.00 | 100.00 | 100.00 | 99.87 | 99.93 | 99.89 | 99.87 | 99.70 | 99.78 |
Dropbox | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
GsmIp | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
HTTP | 86.48 | 100.00 | 92.74 | 86.48 | 86.74 | 86.60 | 86.48 | 100.00 | 92.74 |
Kerberos | 93.15 | 100.00 | 96.45 | 100.00 | 100.00 | 100.00 | 90.62 | 82.85 | 86.56 |
MWBP | 85.71 | 100.00 | 92.30 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
NBNS | 100.00 | 12.12 | 21.61 | 84.18 | 84.31 | 84.24 | 84.18 | 100.00 | 91.41 |
NBSS | 99.73 | 100.00 | 99.86 | 85.79 | 85.79 | 85.79 | 78.55 | 100.00 | 87.98 |
NTP | 91.27 | 100.00 | 95.43 | 97.25 | 97.25 | 97.25 | 97.25 | 100.00 | 98.60 |
POP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
QUIC | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
RPC | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SIP | 91.25 | 100.00 | 95.42 | 93.75 | 93.75 | 93.75 | 91.25 | 91.67 | 91.45 |
SMTP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SSH | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
Average | 96.69 | 95.60 | 94.33 | 97.36 | 97.38 | 97.37 | 96.41 | 96.18 | 95.73 |
5.3.2 Threshold Value.
Protocol | 0.7 Threshold | 0.75 Threshold | 0.8 Threshold | 0.85 Threshold | 0.9 Threshold | 0.95 Threshold | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | |
BACnet | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BJNP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BitTorrent | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
Bootp | 79.06 | 100.00 | 88.30 | 79.06 | 100.00 | 88.30 | 79.06 | 100.00 | 88.30 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
CUPS | 66.66 | 88.23 | 75.94 | 77.77 | 76.08 | 76.91 | 88.88 | 54.05 | 67.22 | 100.00 | 33.58 | 50.27 | 100.00 | 100.00 | 100.00 | 100.00 | 32.37 | 48.90 |
DNS | 99.94 | 99.65 | 99.79 | 99.94 | 99.66 | 99.79 | 99.93 | 99.66 | 99.79 | 99.93 | 99.66 | 99.79 | 99.87 | 99.93 | 99.89 | 97.98 | 100.00 | 98.97 |
Dropbox | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 99.22 | 100.00 | 99.60 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
GsmIp | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 50.00 | 66.66 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
HTTP | 86.48 | 100.00 | 92.74 | 86.48 | 100.00 | 92.74 | 86.48 | 100.00 | 92.74 | 86.48 | 100.00 | 92.74 | 86.48 | 86.74 | 86.60 | 95.32 | 100.00 | 97.60 |
Kerberos | 23.36 | 65.96 | 34.50 | 75.29 | 84.61 | 79.67 | 82.14 | 85.18 | 83.63 | 82.14 | 85.58 | 83.82 | 100.00 | 100.00 | 100.00 | 100.00 | 95.86 | 97.88 |
MWBP | 85.71 | 100.00 | 92.30 | 71.42 | 100.00 | 83.32 | 100.00 | 77.77 | 87.49 | 100.00 | 77.77 | 87.49 | 100.00 | 100.00 | 100.00 | 100.00 | 70.00 | 82.35 |
NBNS | 84.18 | 97.71 | 90.44 | 84.18 | 98.61 | 90.82 | 84.18 | 99.07 | 91.02 | 84.18 | 99.44 | 91.17 | 84.18 | 84.31 | 84.24 | 99.92 | 51.25 | 67.75 |
NBSS | 77.74 | 98.97 | 87.07 | 77.74 | 99.31 | 87.21 | 77.74 | 99.31 | 87.21 | 78.28 | 99.32 | 87.55 | 85.79 | 85.79 | 85.79 | 98.92 | 99.73 | 99.32 |
NTP | 56.60 | 100.00 | 72.28 | 71.57 | 100.00 | 83.42 | 87.92 | 99.70 | 93.44 | 95.51 | 99.74 | 97.57 | 97.25 | 97.25 | 97.25 | 99.25 | 12.72 | 22.54 |
POP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
QUIC | 100.00 | 93.00 | 96.37 | 100.00 | 97.00 | 98.47 | 100.00 | 98.00 | 98.98 | 100.00 | 99.00 | 99.49 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
RPC | 71.42 | 8.77 | 15.62 | 85.71 | 100.00 | 92.30 | 85.71 | 100.00 | 92.30 | 85.71 | 100.00 | 92.30 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SIP | 80.00 | 100.00 | 88.88 | 80.00 | 90.78 | 85.04 | 80.00 | 90.78 | 85.04 | 80.00 | 90.78 | 85.04 | 93.75 | 93.75 | 93.75 | 93.75 | 89.82 | 91.74 |
SMTP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SSH | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
Average | 85.55 | 92.61 | 86.71 | 89.45 | 97.30 | 92.90 | 92.56 | 92.67 | 91.67 | 94.61 | 94.24 | 93.36 | 97.36 | 97.38 | 97.37 | 99.25 | 87.58 | 90.35 |
5.4 Performance Comparison
Protocols | BitMiner | BitFlow | BitPack | BitCoding | BitProb | OptiClass | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | Recall | Precision | F1-Score | |
BACnet | 100.00 | 100.00 | 100.00 | 50.00 | 100.00 | 66.66 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BJNP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 0.00 | 0.00 | 0.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
BitTorrent | 100.00 | 100.00 | 100.00 | 88.77 | 100.00 | 94.05 | 75.00 | 100.00 | 85.71 | 100.00 | 100.00 | 100.00 | 99.36 | 100.00 | 99.67 | 100.00 | 100.00 | 100.00 |
Bootp | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 97.13 | 100.00 | 98.54 | 100.00 | 100.00 | 100.00 |
CUPS | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 93.61 | 73.07 | 82.07 | 82.60 | 73.07 | 77.54 | 100.00 | 100.00 | 100.00 |
DNS | 43.90 | 100.00 | 61.01 | 99.68 | 100.00 | 99.83 | 100.00 | 100.00 | 100.00 | 99.75 | 99.99 | 99.86 | 97.93 | 98.06 | 97.99 | 99.87 | 99.93 | 99.89 |
Dropbox | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 99.87 | 99.87 | 99.87 | 100.00 | 100.00 | 100.00 |
GsmIp | 100.00 | 100.00 | 100.00 | 16.66 | 100.00 | 28.56 | 66.66 | 100.00 | 79.99 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
HTTP | 99.48 | 100.00 | 99.74 | 36.22 | 100.00 | 53.17 | 53.33 | 100.00 | 69.56 | 100 | 100.00 | 100.00 | 86.47 | 99.88 | 92.69 | 86.48 | 86.74 | 86.60 |
Kerberos | 83.03 | 100.00 | 90.73 | 22.86 | 100.00 | 37.21 | 25.00 | 100.00 | 40.00 | 100.00 | 98.60 | 99.29 | 100.00 | 98.60 | 99.29 | 100.00 | 100.00 | 100.00 |
MWBP | 0.00 | 0.00 | 0.00 | 93.16 | 100.00 | 96.45 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
NBNS | 4.72 | 100.00 | 9.01 | 94.47 | 100.00 | 97.15 | 66.66 | 100.00 | 79.99 | 99.05 | 52.42 | 68.55 | 99.05 | 99.52 | 99.28 | 84.18 | 84.31 | 84.24 |
NBSS | 98.65 | 100.00 | 99.32 | 33.75 | 100.00 | 50.46 | 66.66 | 100.00 | 79.99 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 85.79 | 85.79 | 85.79 |
NTP | 99.50 | 100.00 | 99.75 | 94.11 | 100.00 | 96.96 | 92.85 | 100.00 | 96.29 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 97.25 | 97.25 | 97.25 |
POP | 100.00 | 100.00 | 100.00 | 66.66 | 100.00 | 79.99 | 66.66 | 100.00 | 79.99 | 100.00 | 100.00 | 100.00 | 99.11 | 100.00 | 99.55 | 100.00 | 100.00 | 100.00 |
QUIC | 21.50 | 100.00 | 35.39 | 22.22 | 100.00 | 36.36 | 85.00 | 100.00 | 91.89 | 100.00 | 100.00 | 100.00 | 99.54 | 100.00 | 99.76 | 100.00 | 100.00 | 100.00 |
RPC | 100.00 | 100.00 | 100.00 | 75.00 | 100.00 | 85.71 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SIP | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 50.00 | 100.00 | 66.66 | 91.03 | 100.00 | 95.30 | 91.03 | 100.00 | 95.30 | 93.75 | 93.75 | 93.75 |
SMTP | 100.00 | 100.00 | 100.00 | 60.52 | 100.00 | 75.40 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
SSH | 100.00 | 100.00 | 100.00 | 12.34 | 100.00 | 21.96 | 66.66 | 100.00 | 79.99 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 | 100.00 |
Average | 82.53 | 95.00 | 84.74 | 68.32 | 100 | 75.99 | 77.03 | 95.00 | 83.31 | 99.17 | 96.20 | 97.25 | 97.60 | 98.45 | 97.97 | 97.36 | 97.38 | 97.37 |
Protocols | BitMiner | BitFlow | BitPack | BitCoding | BitProb | OptiClass |
---|---|---|---|---|---|---|
BACnet | 1.86 | 1.00 | 1.00 | 1.17 | 0.40 | 0.02 |
BJNP | 1.84 | 1.00 | 1.00 | 1.95 | 0.38 | 0.07 |
BitTorrent | 1.79 | 6.14 | 2.35 | 4.34 | 4.16 | 0.24 |
Bootp | 1.84 | 1.00 | 1.00 | 0.58 | 1.25 | 0.10 |
CUPS | 1.80 | 1.00 | 1.00 | 1.66 | 0.57 | 0.04 |
DNS | 1.98 | 4.46 | 4.10 | 43.66 | 24.00 | 4.88 |
Dropbox | 1.86 | 7.22 | 4.50 | 8.94 | 10.00 | 0.20 |
GsmIp | 1.77 | 1.00 | 1.00 | 0.32 | 0.41 | 0.02 |
HTTP | 2.07 | 6.56 | 3.50 | 98.57 | 184.00 | 4.69 |
Kerberos | 1.84 | 0.03 | 0.02 | 1.01 | 5.93 | 0.18 |
MWBP | 1.75 | 0.04 | 0.02 | 1.35 | 0.45 | 0.02 |
NBNS | 1.87 | 0.70 | 0.40 | 1.35 | 2.06 | 0.23 |
NBSS | 1.78 | 0.04 | 0.03 | 0.67 | 1.57 | 0.16 |
NTP | 1.70 | 0.01 | 0.01 | 0.58 | 1.31 | 0.14 |
POP | 1.82 | 1.00 | 1.00 | 0.33 | 0.59 | 0.05 |
QUIC | 1.76 | 0.01 | 0.01 | 1.77 | 0.64 | 0.05 |
RPC | 1.74 | 1.00 | 1.00 | 0.26 | 0.45 | 0.01 |
SIP | 1.84 | 1.00 | 1.00 | 5.04 | 10.20 | 0.18 |
SMTP | 1.79 | 0.59 | 0.54 | 1.62 | 1.95 | 0.24 |
SSH | 1.85 | 0.68 | 0.57 | 1.41 | 7.75 | 0.18 |
Average | 1.82 | 1.71 | 1.20 | 8.82 | 12.90 | 0.58 |
6 Conclusion and Future Work
7 Acknowledgments
References
Index Terms
- OptiClass: An Optimized Classifier for Application Layer Protocols Using Bit Level Signatures
Recommendations
Strengthening Zero-Knowledge Protocols Using Signatures
Recently there has been an interest in zero-knowledge protocols with stronger properties, such as concurrency, simulation soundness, non-malleability, and universal composability. In this paper we show a novel technique to convert a large class of ...
Proxy Confirmation Signatures
The undeniable signature, introduced by Chaum et al. in 1989, provides a nice property that the signer has an additional control over who will benefit from being convinced by the signature. However, a conspicuous drawback of undeniable signature is that ...
Internet Traffic Classification Using Score Level Fusion of Multiple Classifier
ICIS '10: Proceedings of the 2010 IEEE/ACIS 9th International Conference on Computer and Information ScienceInternet traffic is continuously growing fast due to the rapid spread of the internet and the speed-up of the internet connection. Also, the applications provided on the internet have become more diversified. To support the QoS requirements for these ...
Comments
Information & Contributors
Information
Published In
![cover image ACM Transactions on Privacy and Security](/cms/asset/1432981a-9b70-440f-8f36-6a4968a5ac85/3613489.cover.jpg)
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Check for updates
Author Tags
Qualifiers
- Research-article
Funding Sources
- India. SERB
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 943Total Downloads
- Downloads (Last 12 months)853
- Downloads (Last 6 weeks)146
Other Metrics
Citations
View Options
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in