BLINC: multilevel traffic classification in the dark Export

@inproceedings{citeulike:882494, abstract = {We present a fundamentally different approach to classifying traffic flows according to the applications that generate them. In contrast to previous methods, our approach is based on observing and identifying patterns of host behavior at the transport layer. We analyze these patterns at three levels of increasing detail (i) the social, (ii) the functional and (iii) the application level. This multilevel approach of looking at traffic flow is probably the most important contribution of this paper. Furthermore, our approach has two important features. First, it operates in the dark , having (a) no access to packet payload, (b) no knowledge of port numbers and (c) no additional information other than what current flow collectors provide. These restrictions respect privacy, technological and practical constraints. Second, it can be tuned to balance the accuracy of the classification versus the number of successfully classified traffic flows. We demonstrate the effectiveness of our approach on three real traces. Our results show that we are able to classify 80\%-90\% of the traffic with more than 95\% accuracy.}, address = {New York, NY, USA}, author = {Karagiannis, Thomas and Papagiannaki, Konstantina and Faloutsos, Michalis}, booktitle = {SIGCOMM '05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications}, citeulike-article-id = {882494}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1080119}, citeulike-linkout-1 = {http://dx.doi.org/10.1145/1080091.1080119}, doi = {10.1145/1080091.1080119}, isbn = {1-59593-009-4}, issn = {0146-4833}, keywords = {cetech, classification}, location = {Philadelphia, Pennsylvania, USA}, pages = {229--240}, posted-at = {2009-08-19 15:53:52}, priority = {2}, publisher = {ACM}, title = {BLINC: multilevel traffic classification in the dark}, url = {http://dx.doi.org/10.1145/1080091.1080119}, year = {2005} }

TY - CONF ID - citeulike:882494 L3 - citeulike-article-id:882494 N2 - We present a fundamentally different approach to classifying traffic flows according to the applications that generate them. In contrast to previous methods, our approach is based on observing and identifying patterns of host behavior at the transport layer. We analyze these patterns at three levels of increasing detail (i) the social, (ii) the functional and (iii) the application level. This multilevel approach of looking at traffic flow is probably the most important contribution of this paper. Furthermore, our approach has two important features. First, it operates in the dark , having (a) no access to packet payload, (b) no knowledge of port numbers and (c) no additional information other than what current flow collectors provide. These restrictions respect privacy, technological and practical constraints. Second, it can be tuned to balance the accuracy of the classification versus the number of successfully classified traffic flows. We demonstrate the effectiveness of our approach on three real traces. Our results show that we are able to classify 80%-90% of the traffic with more than 95% accuracy. CY - Philadelphia, Pennsylvania, USA SN - 1-59593-009-4 AD - New York, NY, USA EP - 240 TI - BLINC: multilevel traffic classification in the dark PB - ACM T2 - SIGCOMM '05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications SP - 229 KW - cetech KW - classification AU - Karagiannis, Thomas AU - Papagiannaki, Konstantina AU - Faloutsos, Michalis PY - 2005/// UR - http://dx.doi.org/10.1145/1080091.1080119 ER -