Machine learning based encrypted traffic classification: Identifying SSH and Skype

IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2009

Volumn , Issue , 2009, Pages

  Alshammari, Riyad ^a   Zincir Heywood, A Nur ^a  

^a DALHOUSIE UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ADABOOST; BAYESIAN; ENCRYPTED TRAFFIC; FLOW BASED; IP ADDRESSS; MACHINE-LEARNING; OTHER ALGORITHMS; PAYLOAD INFORMATION; TRAFFIC CLASSIFICATION;

ADAPTIVE BOOSTING; ARTIFICIAL INTELLIGENCE; CRYPTOGRAPHY; INTERNET PROTOCOLS; LEARNING SYSTEMS; SODIUM;

TELECOMMUNICATION TRAFFIC;

EID: 77950563729     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CISDA.2009.5356534     Document Type: Conference Paper

References (35)

1. Wright C., Monrose F., Masson G. M., "HMM Profiles for Network Traffic Classification", Proceedings of the ACM DMSEC, pp 9-15, 2004.
2. Haffner P., Sen S., Spatscheck O., Wang D., "ACAS: Automated Construction of Application Signatures", Proceedings of the ACM SIGCOMM, pp.197-202, 2005.
3. Moore A. W., Zuev D., "Internet Traffic Classification Using Bayesian Analysis Techniques", Proceedings of the ACM SIGMETRICS, pp 50-60, 2005.
4. Moore A., Papagiannaki K., "Toward the Accurate Identification of Network Applications", Proceedings of the Passive & Active Measurement Workshop, 2005.
5. Williams N., Zander S., Armitage G., "A Prelimenary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Comparison", ACM SIGCOMM Computer Communication Review, Vol. 36, No. 5, pp. 5-16, 2006.
6. Zhang Y., Paxson V., "Detecting back doors", Proceedings of the 9th USENIX Security Symposium, pp. 157-170, 2000.
7. Dreger H., Feldmann A., Mai M., Paxson V., Sommer R., "Dynamic application layer protocol analysis for network intrusion detection", Proceedings of the 15th USENIX Security Symposium, pp. 257-272, 2006.
8. Early J., Brodley C., Rosenberg C., "Behavioral authentication of server flows", Proceedings of the 19th Annual Computer Security Applications Conference, pp. 46-55, 2003.
9. Karagiannis, T., Papagiannaki, K., and Faloutsos, M, "BLINC: Multilevel Traffic Classification in the Dark", Proceedings of Applications, Technologies, Architectures, and Protocols For Computer Communications pp 229-240, 2005.
10. Wright C. V., Monrose F., Masson G. M., "On Inferring Application Protocol Behaviors in Encrypted Network Traffic", Journal of Machine Learning Research, (7), pp. 2745-2769, 2006.
11. Bernaille L., Teixeira R., "Early Recognition of Encrypted Applications", Passive and Active Measurement Conference (PAM), Louvainla-neuve, Belgium, April, 2007.
12. Alshammari, Riyad; Nurzincir-Heywood, A., "A flow based approach for SSH traffic detection, " Systems, Man and Cybernetics, 2007. ISIC. IEEE International Conference on, vol., no., pp.296-301, 7-10 Oct, 2007.
13. NLANR, http://pma.nlanr.net/Special.
14. MAWI, http://tracer.csl.sony.co.jp/MAWI/.
15. 1999 DARPA intrusion detection evaluation data, http://www.ll.mit.edu/ IST/ideval/docs/1999schedule.html last accessed Jan. 2008.
16. Bernaille L., Teixeira R., Akodkenou I., "Traffic Classification on the Fly", Proceedings of the ACM SIGCOMM Computer Communication Review, 2006.
17. Erman J., Arlitt M., Mahanti A., "Traffic Classification using Clustering Algorithms", Proceedings of the ACM SIGCOMM, pp. 281-286, 2006.
18. PacketShaper, http://www.packeteer.com/products/packetshaper/.
19. l7-filter, http://l7-filter.sourceforge.net/.
20. NetMate, http://www.ip-measurement.org/tools/netmate/.
21. IETF, http://www3.ietf.org/proceedings/97apr/97apr-final/xrtftr70.htm.
22. Burges C. J. C., "A Tutorial on Support Vector Machines for Pattern Recognition", Data Mining and Knowledge Discovery, 2(2): 1-47, 1998.
23. Alpaydin E., "Introduction to Machine Learning", MIT Press, ISBN: 0-262-01211-1.
24. George H. John and Pat Langley Estimating Continuous Distributions in Bayesian Classifiers. Proceedings of the Eleventh Conference on Uncertainty in Artificial Intelligence. pp. 338-345, Morgan Kaufmann, San Mateo, 1995.
25. J R Quinlan, "C4.5: Programs for Machine Learning", Morgan Kaufmann Publishers, isbn=1-55860-238-0, 1993.
26. Cohen W. W., "Fast effective rule induction", Proceedings of the 12th International Conference on Machine Learning, pp. 115-123, 1995.
27. Montigny-Leboeuf A., Flow Attributes For Use In Traffic Characterization, Journal of CRC Technical Note No. CRC-TN-2005-003, Ottawa, ON, Canada, 2005.
28. WEKA Software, http://www.cs.waikato.ac.nz/ml/weka/.
29. Alshammari, Riyad; Zincir-Heywood, A. Nur, "Investigating Two Different Approaches for Encrypted Traffic Classification, " Privacy, Security and Trust, 2008. PST '08. Sixth Annual Conference on, vol., no., pp.156-166, 1-3 Oct. 2008.
30. S. Baset, H. Schulzrine, "An analysis of the skype peer-to-peer internet telephony protocol, " in INFOCOM06: Proceedings of the 25th IEEE International Conference on Computer Communications, 2006.
31. K Suh, D. R. Figueiredo, J. Kurose, and D. Towsley, "Characterizing and detecting relayed traffic: A case study using skype, " in INFOCOM 06: Proceedings of the 25th IEEE International Conference on Computer Communications, Apr 2006.
32. S. Ehlert, S. Petgang, T. Magedanz, and D. Sisalem, "Analysis and signature of skype VoIP session traffic, " in CIIT 2006: 4th IASTED International Conference on Communications, Internet, and Information Technology, Nov/Dec 2006, pp. 8389.
33. D. Bonfiglio, M. Mellia, M. Meo, D. Rossi, "Detailed analysis of skype traffic", IEEE Transactions on Multimedia, Vol. 11, No.1, Jan 2009.
34. M. Perenyi, A. Gefferth, T. D. Drang, S. Molnar, "Skype traffic identification", IEEE, 2007.
35. E. P. Freire, A. Ziviani, R, M. Salles, "Detecting Skype flows in web traffic", IEEE, 2008.