A survey on internet traffic identification

IEEE Communications Surveys and Tutorials

Volumn 11, Issue 3, 2009, Pages 37-52

  Callado, Arthur ^a   Kamienski, Carlos ^b   Szabó, Géza ^d   Gero, Balázs Péter ^d   Kelner, Judith ^a   Fernandes, Stênio ^c   Sadok, Djamel ^a  

^a FEDERAL UNIVERSITY OF PERNAMBUCO   (Brazil)

^b UNIVERSIDADE FEDERAL DO ABC   (Brazil)

^c Federal Institute of Education Science and Technology   (Brazil)

^d ERICSSON RESEARCH   (Hungary)

Author keywords

Application Identification; Classification; Measurement; Traffic Analysis

Indexed keywords

APPLICATION IDENTIFICATION; CLASSIFICATION; CLASSIFICATION ANALYSIS; IN-NETWORK; INTERNET TRAFFIC; IP TRAFFIC; NETWORK ADMINISTRATOR; NEW APPLICATIONS; PACKET-BASED; RESEARCH TOPICS; RESOURCE DEMANDS; SIGNATURE-MATCHING; TRAFFIC ANALYSIS; USER TRAFFICS;

INTERNET PROTOCOLS; INTERNET SERVICE PROVIDERS; SURVEYS;

INTERNET;

EID: 70349472866     PISSN: None     EISSN: 1553877X     Source Type: Journal    
DOI: 10.1109/SURV.2009.090304     Document Type: Article

References (74)

1. Azzouna, Nadia Ben and Guillemin, Fabrice, Analysis of ADSL Traffic on an IP Backbone Link, IEEE IEEE Global Telecommunications Conference 2003, San Francisco, USA, December 2003.
2. Sullivan, Mark, Surveys: Internet Traffic Touched by Youtube, Light Reading, http://www.lightreading.com/document.asp?doc-id=115816, January 2007.
3. Crovella, Mark and Krishnamurty, Balachander, Internet Measurement: Infrastructure, Traffic and Applications, Book, ISBN-13 978-0470014615, Wiley, 2006.
4. Zhang, Jian and Moore, A., Traffic Trace Artifacts due to Monitoring via Port Mirroring, in: Proc. 5th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services, 2007 (E2EMON '07), May 2007.
5. Cho, Kenjiro; Fukuda, Kenshue; Esaki, Hiroshi and Kato, Akira, The Impact and Implications of the Growth in Residential User-to-User Traffic, ACM SIGCOMM 2006, Pisa, Italy, September 2006.
6. Marques Nt., H. T.; Rocha, L. C., Guerra, P. H., Almeida, J. M., Meira, W., and Almeida, v. A., Characterizing Broadband User Behavior, Proc. 2004 ACM Workshop on Next-Generation Residential Broadband Challenges, NRBC '04. ACM Press, New York, NY, 11-18, October 2004.
7. Balachandran, Anand; voelker, Geoffrey M.; Bahl, Paramvir and Ragan, P. venkat, Characterizing user behavior and network performance in a public wireless LAN, Proceedings of the 2002 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, pp. 195-205, 2002.
8. Karagiannis, Thomas; Broido, Andre; Brownlee, Nevil; Claffy, K.C. and Faloutsos, Michalis, Is P2P dying or just hiding?, IEEE Global Telecommunications Conference, November 2004.
9. Karagiannis, Thomas; Broido, Andre; Faloutsos, Michalis and Claffy, K.C., Transport Layer Identification of P2P Traffic, Internet Measurement Conference (IMC '2004), October 2004.
10. Moore, Andrew W. and Papagiannaki, Konstantina, Toward the Accurate Identification of Network Applications, Passive and Active Measurement Workshop (PAM 2005), March 2005.
11. Madhukar, A. and Williamson, C., A Longitudinal Study of P2P Traf-fic Classification, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, September, 2006.
12. Cherry, S., The voIP Backlash, IEEE Spectr., October 2005, http://spectrum.ieee.org/oct05/1846.
13. Ohm, Paul; Sicker, Douglas and Grunwald, Dirk, Legal Issues Surrounding Monitoring During Network Research, (invited paper), Proc. 7th ACM SIGCOMM Conference on Internet Measurement, San Diego, USA, 2007.
14. Kumar, Anurag; Manjunath, D. and Kuri, Joy, Communication Networking-an Analytical Approach, Morgan Kaufmann Publishers, Elsevier Inc., pp. 656-664, 2004.
15. Shah, Niraj, Understanding network processors, Master's thesis, Department of Eletrical Engineering and Computer Science, University of California, Berkley, 2001.
16. Orebaugh, A., Morris, G., Warnicke, E. and Ramirez, G., Ethereal Packet Sniffing, Syngress Publishing, February 2004.
17. Cisco IOS NetFlow, Introduction to Cisco IOS NetFlow-A Technical Overview, White Paper, Last updated: October 2007, http://www.cisco.com/en/US/ prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod-white-paper0900aecd80406232. html.
18. Sadasivan, G.; Brownlee, N.; Claise, B. and Quittek, J., Architecture for IP Flow Information Export, IP Flow Information Export WG (expires in March 2007), September 2006.
19. Iannaccone, G., Fast Prototyping of Network Data Mining Applications, 7th Passive and Active Measurement Workshop. Adelaide, Australia, March 2006.
20. Duffield, N. and Lund, C., Predicting Resource Usage and Estimation Accuracy in an IP Flow Measurement Collection Infrastructure, ACM Internet Measurement Conference 2003.
21. Duffield, N., Lund, C. and Thorup, M., Estimating Flow Distributions from Sampled Flow Statistics, ACM SIGCOMM 2003, Karlsruhe, Germany, August 2003.
22. Duffield, N.; Lund, C. and Thorup, M., Learn more, sample less: Control of volume and variance in network measurement, IEEE Trans. Inform. Theory, vol.51, no.5, pp. 1756-1775, 2005.
23. Fernandes, S.; Kamienski, C.; Kelner, J.; Sousa, D.; and Sadok, D., A Stratified Traffic Sampling Methodology for Seeing the Big Picture, The International Journal of Computer and Telecommunications Networking (Elsevier Computer Networks), 2008.
24. Sommer, R. and Feldmann, A., NetFlow: Information loss or win?, In Proc. 2nd ACM SIGCOMM Workshop on internet Measurement (Marseille, France, November 06-08, 2002). IMW '02. ACM Press, New York, NY, 173-174.
25. Liu, Yong; Towsley, Don; Ye, Tao and Bolot, Jean, An Information- theoretic Approach to Network Monitoring and Measurement, Internet Measurement Conference, IMC '05, 2005.
26. Liu, W.; and Boutaba, R., pMeasure: A Peer-to-Peer Measurement Infrastructure For the Internet, Computer Communications Journal, Special Issue on Monitoring and Measurements of IP Networks, 2005.
27. Paxson, vern, Bro: A system for detecting network intruders in real-time, Computer Networks, vol.31, no.23-24, pp. 2435-2463, 1999.
28. Wallerich, J., Dreger, H., Feldmann, A., Krishnamurthy, B. and Will-inger, W., A methodology for studying persistency aspects of internet flows, SIGCOMM Comput. Commun. Rev. 35, 2 (April 2005), 23-36.
29. Xu, Kuai; Zhang, Zhi-Li and Bhattacharya, Supratik, Profiling Internet Backbone Traffic: Behavior Models and Applications, ACM SIGCOMM 2005.
30. Lan, K. and Heidemann, J., A measurement study of correlations of internet flow characteristics, Computer Networks 50, 1 (Jan. 2006), 46-62.
31. Papagiannaki, K., Taft, N., Bhattacharyya, S., Thiran, P., Salamatian, K. and Diot, C., A pragmatic definition of elephants in internet backbone traffic, In Proc. 2nd ACM SIGCOMM Workshop on internet Measurement (Marseille, France, November 06-08, 2002). IMW '02. ACM Press, New York, NY, 175-176.
32. Brownlee, N. and Claffy, K.C., Understanding Internet traffic streams: Dragonflies and tortoises, Communications Magazine, IEEE, vol.40, no.10, October 2002, pp. 110-117.
33. Park, Kihong & Willinger, Walter, Self-Similar Network Traffic and Performance Evaluation, Wiley-Interscience, ISBN: 978-0471319740, First Edition, January 2000.
34. Karagiannis, T.; Molle, M. and Faloutsos, M., Long-range dependence-Ten years of Internet traffic modeling, IEEE Internet Computing magazine, volume 8, number 5, pp. 57-64, September 2004.
35. Sarvotham, S., Riedi, R., and Baraniuk, R., Connection-level analysis and modeling of network traffic, In Proc. 1st ACM SIGCOMM Workshop on Internet Measurement (San Francisco, California, USA, November 01-02, 2001).
36. Crovella, Mark, Network Traffic Modeling, PhD lecture, Aalborg University, February 2004.
37. Chen, Thomas M., Network Traffic Modeling, Chapter in "The Handbook of Computer Networks", Bigdoli, Hossein, editor, volume III, Wiley, 2007.
38. Kim, Myung-Sup; Won, Young J. and Hong, James W., Characteristic analysis of internet traffic from the perspective of flows, Computer Communications Journal, 2005.
39. Brownlee, Nevil, Some Observations of Internet Stream Lifetimes, Lecture Notes in Computer Science, volume 3431, January 2005, pp. 265-277.
40. Willinger, Walter; Taqqu, Murad S.; Sherman, Robert and Wilson, Daniel v., Self-Similarity Through High-variability: Statistical Analysis of Ethernet LAN Traffic at the Source Level, IEEE/ACM Trans. Networking, volume 5, pp. 71-86. February 1997.
41. Bacelar, Rodrigo; Kamienski, C. A.; Callado, Arthur; Fernandes, Stênio; Mariz, Dênio and Sadok, Djamel, Performance evaluation of P2P voIP applications, Proc. 17th International workshop on Network and Operating Systems Support for Digital Audio & video (NOSSDAv 2007), Urbana-Champaign, USA. 2007.
42. Sinha, A.; Mitchell, K. and Medhi D., Flow-Level Upstream Traffic Behavior in Broadband Access Networks: DSL versus Broadband Fixed Wireless, IEEE IPOM, 2003.
43. Karagiannis, T., Papagiannaki, K. and Faloutsos, M., BLINC: Multilevel Traffic Classification in the Dark, ACM SIGCOMM 2005, August/September 2005.
44. Moore, Andrew and Zuev, Denis, Internet traffic Classification Using Bayesian Analysis Techniques, Proc. 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, ACM Press, 2005, pp. 50-60.
45. IANA, Port Numbers, http://www.iana.org/assignments/port-numbers.
46. Sen, Subhabrata; Spatscheck, Oliver and Wang, Dongmei, Accurate, Scalable InNetwork Identification of P2P Traffic Using Application Signatures, Proc. 13th international conference on World Wide Web, 2004, pp. 512-521.
47. Haffner, P.; Sen, S.; Spatscheck, O. and Wang, Do., ACAS: Automated Construction of Application Signatures, MineNet 2005.
48. Kim, H. A. and Karp, B., Autograph: Toward Automated, Distributed Worm Signature Detection, Security 2004.
49. Li, Z.; Sanghi, M.; Chen, Y.; Kao, M.-Y. and Chavez, B., Hamsa: Fast Signature Generation for Zero-day Polymorphic Worms with Provable Attack Resilience, IEEE Symposium on Security and Privacy 2006.
50. Markatos, E. P.; Antonatos, S.; Polychronakis, M. and Anagnostakis, K. G., Exclusion-based Signature Matching for Intrusion Detection, In Proc. IASTED International Conference on Communications and Computer Networks, 2002.
51. Erdogan, O. and Cao, P., Hash-Av: Fast virus Signature Scanning by Cache-Resident Filters, IEEE Global Telecommunications Conference, St. Louis, USA, 2005.
52. Roughan, Matthew; Sen, Subhabrata; Spatscheck, Oliver and Duffield, Nick, Class-of-Service Mapping for QoS: A Statistical Signature-based Approach to IP Traffic Classification, Proc. 4th ACM SIGCOMM Conference on Internet Measurement, Taormina, Italy, 2004.
53. Zander, S.; Nguyen, T. and Armitage, G., Automated Traffic Classifi-cation and Application Identification Using Machine Learning, IEEE Conference on Local Computer Networks, 2005.
54. McGregor, A.; Hall, M.; Lorier, P. and Brunskill, A., Flow Clustering Using Machine Learning Techniques, Passive and Active Network Measurement Workshop, 2004.
55. Erman, Jeffrey; Mahanti, Anirben and Arlitt, Martin, Internet Traffic Identification using Machine Learning, Proceeding of the 49th IEEE Global Telecommunications Conference (GLOBECOM), San Francisco, USA, November 2006.
56. Williams, Nigel; Zander, Sebastian and Armitage, Grenville, A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification, ACM SIGCOMM Computer Communication Review, volume 36, issue 5, October 2006.
57. Bonfiglio, Dario; Mellia, Marco; Meo, Michela; Rossi, Dario and Tofanelli, Paolo, Revealing Skype Traffic: when randomness plays with you, ACM SIGCOMM 2007 Data Communication Festival (SIGCOMM 2007), Tokyo, Japan, August 2007.
58. Suh, Kyoungwon; Figueiredo, Daniel R., Kurose, Jim and Towsley, Don, Characterizing and Detecting Skype-Related Traffic, The 25th Conference on Computer Communications. Barcelona, Spain, April 2006.
59. Chhabra, Parminder; John, Ajita and Saran, Huzur, PISA: Automatic Extraction of Traffic Signatures, 4th International IFIP-TC6 Networking Conference, May 2005.
60. Bernaille, Laurent; Teixeira, Renata and Salamantian, Kavé, Early Application Identification, Second Conference on Future Networking Technologies, December 2006.
61. Bernaille, Laurent; Teixeira, Renata; Akodkenou, Ismael; Soule, Au-gustin and Salamantian, Kave, Traffic Classification On The Fly, ACM SIGCOMM Computer Communication Review, volume 36, Number 2, April 2006, pp. 23-26.
62. Bernaille, Laurent and Teixeira, Renata, Early Recognition of Encrypted Applications, in Proc. 8th International Conference, Passive and Active Measurement Conference, Louvain-la-Neuve, Belgium, April 2007.
63. Szabó, G.; Szabo, I. and Orincsay, D., Accurate Traffic Classification, IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks, June 2007.
64. Silvestre, G.; Fernandes, S.; Kamienski, C.; Sousa, D. and Sadok, D., Padrões de Comportamento de Tráfego P2P, Proc. III Workshop of Peer-to-Peer (WP2P 2007), June 2007.
65. Andersson, L.; Davies, E. and Zahng, L., Report from the IAB workshop on Unwanted Traffic, Internet-Draft, IETF Network Working Group, February 2007.
66. Soule, A.; Salamantian, K. and Taft, N., Combining Filtering and Statistical Methods for Anomaly Detection, Proc. Internet Measurement Conference 2005, pp. 331-344, 2005.
67. Huang, C.-T.; Thareja, S. and Shin, Y.-J., Wavelet-based Real Time Detection of Network Traffic Anomalies, Proc. Workshop on Enterprise Network Security (WENS 2006), August 2006.
68. Magnaghi, A.; Hamada, T. and Katsuyama, T., A Wavelet-based Framework for Proactive Detection of Network Misconfigurations, Proc. ACM SIGCOMM workshop on Network troubleshooting: Research, theory and operations practice meet malfunctioning reality, pp. 253-258, 2004.
69. Lakhina, Anukool; Crovella, Mark and Diot, Christophe, Mining Anomalies Using Traffic Feature Distributions, ACM SIGCOMM Computer Communication Review, volume 35, Issue 4, pp. 217-228, 2005.
70. Szabó, G.; Orincsay, D.; Malomsoky, S. and Szabó, I., On the validation of Traffic Classification Algorithms, Passive and Active Measurements Workshop, April 2008.
71. Jiang, Hongbo; Moore, Andrew; Ge, Zihui; Jin, Shudong and Wang, Jia, Lightweight Application Classification for Network Management, SIG-COMM Workshop on Internet Network Management (INM), August, 2007.
72. Karagiannis, T.; Papagiannaki, K.; Taft, N. and Faloutsos, M., Profiling the End Host, in Proceedings of the 8th International Conference, Passive and Active Measurement Conference, Louvain-la-Neuve, Belgium, pp. 186-196, April 2007.
73. Kundu, Sumantra; Pal, Sourav; Basu, Kalyan and Das, Sajal, Fast Classification and Estimation of Internet Traffic Flows, in Proc. 8th International Conference on Passive and Active Measurement, Louvain-la-Neuve, Belgium, April 2007.
74. Tai, Masaki; Ata, Shingo and Oka, Ikuo, Fast, Accurate, and Lightweight Real-time Traffic Identification Method based on Flow Statistics, in Proc. 8th International Conference, Passive and Active Measurement Conference, Louvain-la-Neuve, Belgium, pp. 255-299, April 2007.