Statistical traffic classification on high-speed, multi-Gb/s links has up to now been possible only with specialized, often proprietary, always quite costly hardware. In this paper we present MTCLASS, a new, multi-threaded, modular Internet statistical traffic analysis engine capable of running in real-time on commodity hardware processing multi-Gb/s traffic aggregates. Experimental results show that our engine, running on a low cost dual Xeon PC with a total of 12 cores at 2.6GHz can classify in real time using a Support Vector Machine (SVM) algorithm aggregates of up to 1.14 million packets per second, corresponding in the traces we used to a bit rate of 5.3 Gbps. We make MTCLASS' source code available to the community under an open source license.

In this paper we present a software-based traffic classification engine running on commodity multi-core hardware, able to process in real-time aggregates of up to 14.2 Mpps over a single 10 Gbps interface -- i.e., the maximum possible packet rate over a 10 Gbps Ethernet links given the minimum frame size of 64 Bytes.

Traffic classification on high-speed, multi-Gb/s links has up to now been demonstrated on complex Linux setups using multi-queue Ethernet cards, thread affinity, zero-copy buffers and specialized socket types. Although these approaches do work in principle, the complexity of the involved networking system ends up consuming almost all computational resources to pass packets between kernel and user space, leaving no CPU time to run any actual statistical classification algorithm. In this paper we present a new approach that harnesses a lightweight and inexpensive NetFPGA/1G to group incoming packets in jumboframes so that almost all CPU cycles of a commodity PC running a stock Linux kernel can be dedicated to run a statistical traffic classification algorithm. Experimental results show that our inexpensive setup can execute Support Vector Machine traffic classification in real time to aggregates of up to 7.44M pps. We make MTCLASS' source code available to the community under an open source license.

In this paper we describe a practical yet effective technique to monitor the amount of bytes that several classes of protocols, such as peer-to-peer, e-mail, etc., transmit over encrypted virtual links, such as IPSec tunnels. The experiments described in this paper demonstrate that our regression-tree-based bandwidth estimator is effective enough to create usage models inherently robust to changes in path, number of users and type of protocols multiplexed over the encrypted link. In other words, our experimental results indicate that training data obtained from a test IPSec tunnel can be successfully used to monitor bandwidth usage on other encrypted tunnels where only the ciphertext is available.

A wide range of traffic classification approaches has been proposed in the last few years by the scientific community. However, the development of complete classification architectures that work directly in real-time on high capacity links is limited. In this paper we present the implementation of a machine-learning technique (SVM), one of the most accurate but most computationally expensive mechanisms, on the CoMo project infrastructure. We show the computational time required to process different traffic traces and the optimization steps we adopted to improve the performance of the system and achieve real-time classification on high-speed links.

Monitoring, anomaly detection and forensics are essential tasks that must be carried out routinely for every computer network. The sheer volume of data generated by conventional anomaly detection tools such as Snort often makes it difficult to explain the nature of an attack and track down its source. In this paper we present TVi, a tool that combines multiple visual representations of network traces carefully designed and tightly coupled to support different levels of visual-based querying and reasoning required for making sense of complex traffic data. TVi allows analysts to visualize data starting at a high level, providing information related to the entire network, and easily move all the way down to a very low level, providing detailed information about selected hosts, anomalies and attack paths. We designed TVi with scalability and extensibility in mind: its DBMS foundations make it scalable with virtually no limitations, and other state-of-the-art IDS, like Snort or Bro, can be easily integrated in our tool. We demonstrate with two case studies, a synthetic dataset (DARPA 1999) and a real one (University of Brescia, UniBS, 2009), how TVi can enhance a network administrator's ability to reveal hidden patterns in network traces and link their key information so as to easily reveal details that by merely observing Snort's output would go unnoticed. We make TVi's source code available to the community under an Open Source license.

Abstract—Peer-to-Peer IP Television (P2PTV) applications represent one of the fastest growing application classes on the Internet, both in terms of their popularity and in terms of the amount of traffic they generate. While network operators require monitoring tools that can effectively analyze the traffic produced by these systems, few techniques have been tested on these mostly closed-source, proprietary applications. In this paper we examine the properties of three traffic classifiers applied to the problem of identifying P2PTV traffic. We report on extensive experiments conducted on traffic traces with reliable ground truth information, highlighting the benefits and shortcomings of each approach. The results show that not only their performance in terms of accuracy can vary significantly, but also that their usability features suggest different effective aspects that can be integrated. I.

This paper introduces a new statistical classification technique that allows a coarse but effective estimation of the amount of bytes that different classes of protocols, such as Peer-to-Peer, web, e-mail, etc., carry over a given communication link. The technique works by observing only IP-level information and without requiring the reconstruction of transport-layer sessions, making it amenable to the monitoring of both clear-text and encrypted traffic aggregates. Results of practical experiments demonstrate that our coarse classifier can estimate with reasonable accuracy the amount of bytes carried on a communication link by a given traffic class both cumulatively and punctually, i.e., over both long and short time periods. Furthermore, preliminary results demonstrate the effectiveness of the technique in monitoring encrypted links, albeit under restrictive assumptions.

Supervised statistical approaches for the classification of network traffic are quickly moving from research laboratories to advanced prototypes, which in turn will become actual products in the next few years. While the research on the classification algorithms themselves has made quite significant progress in the recent past, few papers have examined the problem of determining the optimum working parameters for statistical classifiers in a straightforward and foolproof way. Without such optimization, it becomes very difficult to put into practice any classification algorithm for network traffic, no matter how advanced it may be. In this paper we present a simple but effective procedure for the optimization of the working parameters of a statistical network traffic classifier. We put the optimization procedure into practice, and examine its effects when the classifier is run in very different scenarios, ranging from medium and large local area networks to Internet backbone links. Experimental results show not only that an automatic optimization procedure like the one presented in this paper is necessary for the classifier to work at its best, but they also shed some light on some of the properties of the classification algorithm that deserve further study.

Abstract The Third‐generation Partnership Project (3GPP) Release 6 is an important step towards next generation mobile networks, integrating the IP Multimedia Subsystem, a core network completely based on IETF protocols. At the same time, the access network is being redefined to be able to support a variety of different wireless technologies, enabling the use of new, multi‐interface, powerful end‐devices. Security will necessarily represent a critical issue for the success of this new architecture, especially for the signaling plane, where the Session Initiation Protocol (SIP) plays a key role. SIP does not offer any built‐in security features, therefore 3GPP technical specifications require SIP to be protected by IPSec security associations. This can lead to significant computational and spatial overheads both in the core network and in the terminals, which might affect their performance. In this paper we analyze the overheads due to security mechanisms designed to protect signaling in Beyond‐3G core networks and mobile terminals. We show that in both cases such overheads can have a significant effect on the performance of the entire architecture. Copyright © 2009 John Wiley & Sons, Ltd.

A common belief in the scientific community is that traffic classifiers based on deep packet inspection (DPI) are far more expensive in terms of computational complexity compared to statistical classifiers. In this paper we counter this notion by defining accurate models for a deep packet inspection classifier and a statistical one based on support vector machines, and by evaluating their actual processing costs through experimental analysis. The results suggest that, contrary to the common belief, a DPI classifier and an SVM-based one can have comparable computational costs. Although much work is left to prove that our results apply in more general cases, this preliminary analysis is a first indication of how DPI classifiers might not be as computationally complex, compared to other approaches, as we previously thought.

Statistical traffic classification techniques are often developed under the assumption that monitoring devices can observe the two half-flows composing each traffic session. However, the practice of asymmetric routing is rapidly moving from the Internet core to its edge. Forecasts [1] predict that in a few years even the last legs of Internet connectivity will experience some form of this practice. In this paper we study the effects that asymmetric routing can have on statistical traffic classifiers. We do so by comparing the capability of unidirectional classifiers with the ones of bidirectional classifiers in extracting information from the features of half-flows. Numerical results obtained by processing three heterogeneous traffic traces not only confirm the obvious assumption that bidirectional classifiers work better than unidirectional ones, but also shed some light on a few interesting facts. First, that the improvement introduced by bidirectional classifiers is not very significant in terms of increased true positives, while it is substantial in terms of decreased false positives. Furthermore, some protocols seem to exhibit, at least in some environments, the tendency to carry more information (relevant to traffic classification) in one direction than in the other.

When employing cryptographic tunnels such as the ones provided by Secure Shell (SSH) to protect their privacy on the Internet, users expect two forms of protection. First, they aim at preserving the privacy of their data. Second, they expect that their behavior, e.g., the type of applications they use, also remains private. In this paper we report on two statistical traffic analysis techniques that can be used to break the second type of protection when applied to SSH tunnels, at least under some restricting hypothesis. Experimental results show how current implementations of SSH can be susceptible to this type of analysis, and illustrate the effectiveness of our two classifiers both in terms of their capabilities in analyzing encrypted traffic and in terms of their relative computational complexity.

The secure shell protocol strives to protect the privacy of its users in several ways. On one hand, the strong encryption and authentication algorithms that it adopts provide guarantees that the data exchanged between two SSH endpoints remain private to third parties. On the other hand, the type of traffic that each SSH channel transports, such as e-mail, remote shell activity, etc., is also supposed to be hidden from any observer that does not possess the necessary keys. This paper introduces a simple but accurate model of the SSH channel which can be used to study the level of privacy that SSH-protected traffic can achieve with respect to the users' activities. We think that the model can facilitate several types of projects. For example, network managers can detect traffic anomalies hidden by SSH connections more easily by relying on the output of our model. Another example, which we present in this paper, is the use of this model to derive accurate fingerprints of the type of applications run through an SSH channel by simply starting from the statistics of captured clear-text traffic. Such fingerprints can then be used to detect what type of activity, i.e., what type of traffic, is going on within an SSH channel, thereby breaking user privacy.

The use of covert application-layer tunnels to bypass security gateways has become quite popular in recent years. By encapsulating blocked or controlled protocols such as peer- to-peer, chat and e-mail into others allowed by the security policies, such as HTTP, SSH or even DNS, both legitimate and malicious users can effectively neutralize many security restrictions enforced at the network edge. Traditional firewalling techniques, based on Application Layer Gateways and even pattern-matching mechanisms are becoming practically useless as tunneling tools grow more sophisticated. In this paper we propose an effective solution to this problem based on a statistical traffic classification technique. Our mechanism relies on the creation of a statistical fingerprint of legitimate usage of a given protocol, such as regular remote interactive logins or secure copying activities. Such fingerprint can then be used to detect with high accuracy non-legitimate sessions, i.e., sessions that tunnel other protocols. Results from experiments conducted on a live network suggest that the technique can be very effective, even when the application layer protocol used as a tunnel is encrypted, such as in the case of SSH.

Secure Shell (SSH) tunnels are commonly used to provide two types of privacy protection to clear-text application protocols. First and foremost, they aim at protecting the privacy of the data being exchanged between two peers, such as passwords, details of monetary transactions and so on. Second, they are supposed to protect the privacy of the behavior of end-users, by preventing an unauthorized observer from detecting which application protocol is being transported by an SSH tunnel. In this paper we introduce a GMM-based (Gaussian Mixture Model) technique that, under a set of reasonable assumptions, can be used to identify which application is being tunneled inside an SSH session by simply observing the stream of encrypted packets. This technique can therefore break the presumption of privacy in its second incarnation as described above. Although still preliminary, experimental results show that the technique can be quite effective, and that the standard bodies might need to take this approach under consideration when designing new obfuscation techniques for SSH.

The classification of IP flows according to the application that generated them has become a popular research subject in the last few years. Several recent papers based their studies on the analysis of features of flows such as the packet size and inter-arrival time, which are then used as input to classification techniques derived from various scientific areas such as pattern recognition. In this paper we analyze the impact on flow classification of a hypothesis that is often overlooked, i.e., the tenet that the features of consecutive packets of a given IP flow can be considered statistically independent. We compare two approaches, one based on a technique that considers consecutive packets statistically independent, and one that relies on the opposite assumption. These techniques are then applied to three different sets of traffic traces. Experimental results show that while assuming the independence of consecutive packets has relatively few effects on true positives, it can have a significant negative impact on the false positive and true negative rates, therefore lowering the precision of the classification process.

Application level gateways and firewalls are commonly used to enforce security policies at network boundaries, especially in large-sized business networks. However, several mechanisms can be used to circumvent these policies and bypass the whole security infrastructure: for example, tunneling an (otherwise blocked) application layer protocol into another one allowed by the policy, such as HTTP. In this paper we propose the application of a statistically-based traffic classification technique to solve this problem. By the analysis of inter-arrival time, size and order of the packets crossing a gateway, we show that it is possible to detect with high accuracy whether an observed flow is carrying a legitimate HTTP session, or the flow is being used to tunnel another protocol. This paper describes how this technique can be used effectively to enhance application level gateways and firewalls, helping to better apply network security policies.

Correct classification of traffic flows according to the application layer protocols that generated them is essential for most network-management, resource allocation and intrusion detection systems in TCP/IP networks. With the ever increasing number of network protocols and services running on non-standard TCP ports, the classification methods based on the analysis of the transport layer header are rapidly becoming ineffective. On the other hand, mechanisms based on full payload analysis are too computationally demanding to be run on most high-bandwidth links. Here we present a novel classification technique based on the statistical analysis of network traffic performed at the IP-level. The key idea behind our approach is to build a set of protocol fingerprints that we believe summarize, in a compact and efficient way, the main IP-level statistical properties of application layer protocols. By means of a simple, lightweight algorithm based on the notion of anomaly scores, also presented in this paper, an unknown flow can be compared against known protocol fingerprints, detecting the application that generated the flow. Our methodology is completely based on IP-level analysis: no payload analysis or port analysis is required for the classification of an unknown flow. Besides introducing our approach, we describe preliminary experimental results that show how this technique is effective in correctly classifying network traffic in a real network environment.

The majority of the authentication methods used in modern wireless local area networks (WLANs) are inherited from protocols designed for wired networks. They provide a good level of security, but they do not support mobility well and they are not computationally efficient. More efficient and mobility-friendly mechanisms, based on pre-shared keys (PSK), are beginning to appear, but they present significant issues with the provisioning and management of the credentials they need. In this paper we introduce smart PSK provisioning (SPP), a combination of two classes of authentication methods. By taking advantage of the combined features of TLS-based and PSK-based authentication mechanisms, SPP provides security, network and computational efficiency, manageability of credentials and modularity. Qualitative and quantitative analysis show how SPP satisfies all these requirements, and how its performance compares very favorably with that of TLS-based authentication mechanisms.

The third-generation (3G) wide area wireless networks and 802.11 local area wireless networks possess complementary characteristics. 3G networks promise to offer always-on, ubiquitous connectivity with relatively low data rates. 802.11 offers much higher data rates, comparable to wired networks, but can cover only smaller areas, suitable for hot-spot applications in hotels and airports. The performance and flexibility of wireless data services would be dramatically improved if users could seamlessly roam across the two networks. In this paper, we address the problem of integration of these two classes of networks to offer such seamless connectivity. Specifically, we describe two possible integration approaches - namely tight integration and loose integration and advocate the latter as the preferred approach. Our realization of the loose integration approach consists of two components: a new network element called IOTA gateway deployed in 802.11 networks, and a new client software. The IOTA gateway is composed of several software modules, and with cooperation from the client software offers integrated 802.11/3G wireless data services that support seamless intertechnology mobility, Quality of Service (QoS) guarantees and multiprovider roaming agreements. We describe the design and implementation of the IOTA gateway and the client software in detail and present experimental performance results that validate our architectural approach.

Mobile IP is the current standard for supporting macromobility of mobile hosts. However, in the case of micromobility support, there are several competing proposals. We present the design, implementation and performance evaluation of HAWAII (handoff-aware wireless access Internet infrastructure), a domain-based approach for supporting mobility. HAWAII uses specialized path setup schemes which install host-based forwarding entries in specific routers to support intra-domain micromobility. These path setup schemes deliver excellent performance by reducing mobility related disruption to user applications. Also, mobile hosts retain their network address while moving within the domain, simplifying quality-of-service (QoS) support. Furthermore, reliability is achieved through maintaining soft-state forwarding entries for the mobile hosts and leveraging fault detection mechanisms built in existing intra-domain routing protocols. HAWAII defaults to using Mobile IP for macromobility, thus providing a comprehensive solution for mobility support in wide-area wireless networks.

In this paper we present techniques for allowing Mobile IP to interwork with wide area cellular networks. As an example, we illustrate a network consisting of a GSM general packet radio service (GPRS) air interface and a Mobile IP backbone network. The advantage of such a solution is that the backbone network may easily be used to support integrated wireless and wired data transfer, and the leveraging of standard data networking protocols and equipment will reduce the cost of wireless data networks. We present issues and suggested solutions for mobility management functions, such as detecting changes in points of attachment to a network, micromobility, roaming, and paging, and security functions, such as authentication and ciphering. We show which elements of each network, GSM and Mobile IP, may be re-used, combined, or eliminated to provide a single, unified network.