On inferring application protocol behaviors in encrypted network traffic

Journal of Machine Learning Research

Volumn 7, Issue , 2006, Pages 2745-2769

  Wright, Charles V ^a   Monrose, Fabian ^a   Masson, Gerald M ^a  

^a JOHNS HOPKINS UNIVERSITY   (United States)

Author keywords

Hidden Markov models; Network security; Traffic classification

Indexed keywords

CRYPTOGRAPHY; MARKOV PROCESSES; NETWORK PROTOCOLS; PACKET NETWORKS; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

ENCRYPTED NETWORK TRAFFIC; HIDDEN MARKOV MODELS; NETWORK SECURITY; TRAFFIC CLASSIFICATION;

TELECOMMUNICATION NETWORKS;

EID: 33845735523     PISSN: 15324435     EISSN: 15337928     Source Type: Journal    
DOI: None     Document Type: Article

References (39)

1. Leonard E Baum, Ted Petrie, George Soules, and Norman Weiss. A maximization technique occurring in the statistical analysis of probabilistic functions of Markov chains. Annals of Mathematical Statistics, 41(1): 164-171, February 1970.
2. Laurent Bernaille, Renata Teixeira, Ismael Akodkenou, Augustin Soule, and Kave Salamatian. Traffic classification on the fly. ACM SIGCOMM Computer Communication Review, 36(2):23-26, April 2006.
3. Bram Cohen. Incentives build robustness in BitTorrent. In Workshop on Economics of Peer-to-Peer Systems, June 2003.
4. th Annual Computer Security Applications Conference, pages 24-33, December 2003.
5. Joseph L Doob. Stochastic Processes. Wiley, 1953.
6. th Usenix Security Symposium, pages 257-272, August 2006.
7. th Annual Computer Security Applications Conference, pages 46-55, December 2003.
8. Sean Eddy. Multiple alignment using hidden Markov models. In Proceedings of the Third International Conference on Intelligent Systems for Molecular Biology, pages 114-120, July 1995.
9. Sean Eddy, Graeme Mitchison, and Richard Durbin. Maximum discrimination hidden Markov models of sequence consensus. Journal of Computational Biology, 2:9-23, 1995.
10. Don Faxon, R Duane King, John T Rigsby, Steve Bernard, and Edward J Wegman. Data cleansing and preparation at the gates: A data-streaming perspective. In 2004 Proceedings of the American Statistical Association, August 2004.
11. Federal Information Processing Standards. Advanced Encryption Standard (AES) - FIPS 197, November 2001.
12. Anja Feldmann. Characteristics of TCP connection arrivals. Park and Willinger (Ed). Wiley-Interscience, 2000.
13. Edward W Felten and Michael A Schneider. Timing attacks on web privacy. In Proceedings of the 7th ACM conference on computer and communications security, pages 25-32, November 2000.
14. Thomas Karagiannis, Konstantina Papagiannaki, and Michails Faloutsos. BLINC: Multilevel traffic classification in the dark. In ACM SIGCOMM, to appear, August 2005.
15. Stephen Kent and Ran Atkinson. RFC 2406: IP encapsulating security payload (ESP), November 1998.
16. Tadayoshi Kohno, Andre Broido, and kc claffy. Remote physical device fingerprinting. In Proceedings of the 2005 IEEE Symposium on Security and Privacy, pages 211-225, May 2005.
17. Anders Krogh, Michael Brown, I Saira Mian, Kimmen Sjölander, and David Haussler. Hidden Markov Models in computational biology: Applications to protein modeling. Journal of Molecular Biology, 235(5):1501-1531, February 1994.
18. Solomon Kullback and Richard A Leibler. On information and sufficiency. The Annals of Mathematical Statistics, 22(1):79-86, March 1951.
19. Wenke Lee and Dong Xiang. Information-theoretic measures for anomaly detection. In Proceedings of the 2001 IEEE Symposium on Security and Privacy, pages 130-143, May 2001.
20. Richard P Lippmann, David J Fried, Isaac Graf, Joshua W Haines, Kristopher R Kendall, David McClung, Dan Weber, Seth E Webster, Dan Wyschogrod, Robert K Cunningham, and Marc A Zissmann. Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation. In Proceedings of the 2000 DARPA Information Survivability Conference and Exposition, January 2000.
21. th Anuual Passive and Active Measurement Workshop (PAM 2004), April 2004.
22. John McHugh. Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Transactions on Information and System Security, 3(4):262-294, November 2000.
23. th Anuual Passive and Active Measurement Workshop (PAM 2005), March 2005.
24. Andrew W Moore and Denis Zuev. Internet traffic classification using Bayesian analysis techniques. In ACM SIGMETRICS, June 2005.
25. Vern Paxson. Emprically-derived analytic models of wide-area tcp connections. IEEE/ACM Transactions on Networking, 2(4):316-336, August 1994.
26. Eric Rescorla. SSL and TLS: Designing and Building Secure Systems. Addison-Wesley, 2000.
27. Alexander Schliep, Alexander Schönhuth, and Christine Steinhoff. Using hidden Markov models to analyze gene expression time course data. Bioinformatics, 19(supplement 1):i255-i263, July 2003.
28. th USENIX Security Symposium, August 2001.
29. Qixiang Sun, Daniel R Simon, Yi-Min Wang, Will Russell, Venkata N Padmanabhan, and Lili Qiu. Statistical identification of encrypted web browsing traffic. In Proceedings of the IEEE Symposium on Security and Privacy, pages 19-30, May 2002.
30. Andrew J Viterbi. Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory, IT-13:260-267, 1967.
31. th European Symposium on Research in Computer Security (ESORICS), pages 244-263, October 2002.
32. David Williams. Probability with Martingales. Cambridge University Press, 1991.
33. Charles Wright, Fabian Monrose, and Gerald M Masson. HMM profiles for network traffic classification (extended abstract). In Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, pages 9-15, October 2004.
34. rd International Workshop on Visualization for Computer Security, November 2006. To appear.
35. Kuai Xu, Zhi-Li Zhang, and Supratik Bhattacharya. Profiling internet backbone traffic: Behavior models and applications. In SIGCOMM '05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 169-180, August 2005.
36. th USENIX Security Symposium, pages 37-42, July 1996.
37. th European Symposium on Research in Computer Security (ESORICS), pages 191-205, October 2000.
38. th USENIX Security Symposium, pages 157-170, August 2000a.
39. th USENIX Security Symposium, pages 171-184, August 2000b.