Using GMM and SVM-based techniques for the classification of SSH-encrypted traffic

IEEE International Conference on Communications

Volumn , Issue , 2009, Pages

  Dusi, Maurizio ^a   Este, Alice ^a   Gringoli, Francesco ^a   Salgarelli, Luca ^a  

^a UNIVERSITY OF BRESCIA   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

ENCRYPTED TRAFFIC; SECURE SHELL; TRAFFIC-ANALYSIS TECHNIQUES;

COMPUTATIONAL COMPLEXITY; CRYPTOGRAPHY; WIND TUNNELS;

INTERNET PROTOCOLS;

EID: 70449463526     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2009.5199557     Document Type: Conference Paper

References (20)

1. T. Ylonen and C. Lonvick, "The Secure Shell (SSH) Protocol Architecture," RFC 4251, IETF, Jan. 2006.
2. F. Gringoli, "sshgate." http://sourceforge.net/projects/ sshgate.
3. C. V. Wright, F. Monrose, and G. M. Masson, "On Inferring Application Protocol Behaviors in Encrypted Network Traffic," Journal of Machine Learning Research, vol. 7, pp. 2745-2769, Dec. 2006.
4. M. Dusi, M. Crotti, F. Gringoli, and L. Salgarelli, "Detection of Encrypted Tunnels across Network Boundaries," in Proceedings of the 43rd IEEE International Conference on Communications (ICC 2008), (Beijing, China), May 2008.
5. L. Bernaille and R. Teixeira, "Early Recognition of Encrypted Applications," in Proceedings of the 8th Passive and Active Measurement Conference (PAM 2007), (Louvain-la-neuve, Belgium), Apr. 2007.
6. C. Wright, F. Monrose, and G. M. Masson, "HMM profiles for network traffic classification," in Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, (Washington DC, USA), October 2004.
7. M. Dusi, F. Gringoli, and L. Salgarelli, "A Preliminary Look at the Privacy of SSH Tunnels," in Proceedings of the 17th IEEE International Conference on Computer Communications and Networks (ICCCN 2008), (St. Thomas, U.S. Virgin Islands), Aug. 2008.
8. V. N. Vapnik, Statistical learning theory. Adaptive and learning systems for signal processing, communications, and control. New York: Wiley, 1998.
9. N. Williams, S. Zander, and G. Armitage, "A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification," SIGCOMM Computer Communication Review, vol. 36, no. 5, pp. 7-15, 2006.
10. N. Williams, S. Zander, and G. Armitage, "Evaluating Machine Learning Algorithms for Automated Network Application Identification," Tech. Rep. 060410B, Centre for Advanced Internet Architectures (CAIA), Mar. 2006.
11. A. Este, F. Gringoli, and L. Salgarelli, "Support Vector Machines for TCP Traffic Classification," tech. rep., Università degli Studi di Brescia, July 2008.
12. G. J. McLachlan and D. Peel, Finite Mixture Models. New York: Wiley, 2000.
13. A. Dempster, N. Laird, D. Rubin, "Maximum likelihood from incomplete data via the EM algorithm," Journal of the Royal Statistical Society, vol. 39, no. 1, pp. 1-38, 1977.
14. C. J. V. Rijsbergen, Information Retrieval. Newton, MA: Butterworth-Heinemann, 1979.
15. B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, R.C. Williamson, "Estimating the Support of a High-Dimensional Distribution," Neural Computation, vol. 13, pp. 1443-1471, 2001.
16. M. Crotti, M. Dusi, F. Gringoli, and L. Salgarelli, "Traffic Classification through Simple Statistical Fingerprinting," ACM SIGCOMM Computer Communication Review, vol. 37, pp. 5-16, Jan. 2007.
17. "L7 Filter." http://l7-filter.sourceforge.net.
18. T. Ylonen and C. Lonvick, "The Secure Shell (SSH) Authentication Protocol," RFC 4252, IETF, Jan. 2006.
19. T. Ylonen and C. Lonvick, "The Secure Shell (SSH) Transport Layer Protocol," RFC 4253, IETF, Jan. 2006.
20. "OpenSSH." http://www.openssh.org.