Analysis of the impact of sampling on NetFlow traffic classification

Computer Networks

Volumn 55, Issue 5, 2011, Pages 1083-1099

  Carela Español, Valentín ^a   Barlet Ros, Pere ^a   Cabellos Aparicio, Albert ^a   Solé Pareta, Josep ^a  

^a UNIVERSITAT POLITÈCNICA DE CATALUNYA   (Spain)

Author keywords

Machine learning; Network management; Traffic classification

Indexed keywords

ADAPTED METHODS; MACHINE-LEARNING; NETFLOW DATA; NETFLOWS; NETWORK OPERATOR; PACKET-BASED; TRAFFIC CLASSIFICATION;

LEARNING SYSTEMS; TELECOMMUNICATION TRAFFIC;

NETWORK MANAGEMENT;

EID: 79952438076     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2010.11.002     Document Type: Article

References (57)

1. Internet Assigned Numbers Authority (IANA), 2008. .
2. T. Karagiannis, A. Broido, N. Brownlee, K. Claffy, M. Faloutsos, File-sharing in the Internet: A Characterization of P2P Traffic in the Backbone, Univ. of California, Riverside, Tech. Rep.
3. T. Karagiannis, A. Broido, N. Brownlee, K. Claffy, M. Faloutsos, Is P2P dying or just hiding? in: Proceedings of IEEE GLOBECOM, November, 2004.
4. T. Karagiannis, A. Broido, M. Faloutsos, Transport layer identification of P2P traffic, in: Proceedings of ACM SIGCOMM IMC, August, 2004.
5. A. Moore, K. Papagiannaki, Toward the accurate identification of network applications, in: Proceedings of PAM Conference, March, 2005.
6. S. Sen, O. Spatscheck, D. Wang, Accurate, scalable in-network identification of P2P traffic using application signatures, in: Proceedings of WWW Conference, May, 2004.
7. T. Auld, A. Moore, and S. Gull Bayesian neural networks for Internet traffic classification IEEE Trans. Neural Networks 18 1 2007
8. M. Crotti, and F. Gringoli Traffic classification through simple statistical fingerprinting ACM SIGCOMM Comput. Commun. Rev. 37 1 2007
9. P. Haffner, S. Sen, O. Spatscheck, D. Wang, ACAS: automated construction of application signatures, in: Proceedings of ACM SIGCOMM MineNet, August, 2005.
10. H. Jiang, A. Moore, Z. Ge, S. Jin, J. Wang, Lightweight application classification for network management, in: Proceedings of ACM SIGCOMM INM Workshop, August, 2007.
11. A. Moore, D. Zuev, Internet traffic classification using bayesian analysis techniques, in: Proceedings of ACM SIGMETRICS, June, 2005.
12. M. Roughan, S. Sen, O. Spatscheck, N. Duffield, Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification, in: Proceedings of ACM SIGCOMM IMC, October, 2004.
13. D. Zuev, A. Moore, Traffic classification using a statistical approach, in: Proceedings of PAM Conference, March, 2005.
14. G. Szabo, I. Szabo, D. Orincsay, Accurate traffic classification, in: Proceedings of IEEE WoWMoM, June, 2007.
15. L. Bernaille, R. Teixeira, K. Salamatian, Early application identification, in: Proceedings of ACM CoNEXT, December, 2006.
16. L. Bernaille, I. Akodkenou, A. Soule, and K. Salamatian Traffic classification on the fly ACM SIGCOMM Comput. Commun. Rev. 36 2 2006
17. L. Bernaille, R. Teixeira, Early recognition of encrypted applications, in: Proceedings of PAM Conference, April, 2007.
18. A. Dainotti, W. de Donato, A. Pescape, P. Rossi, Classification of network traffic via packet-level hidden Markov models, in: Proceedings of IEEE GLOBECOM, November, 2008.
19. J. Erman, M. Arlitt, A. Mahanti, Traffic classification using clustering algorithms, in: Proceedings of ACM SIGCOMM MineNet, September, 2006.
20. J. Erman, A. Mahanti, M. Arlitt, I. Cohen, and C. Williamson Offline/realtime traffic classification using semi-supervised learning Perform. Evaluation 64 9-12 2007
21. J. Erman, A. Mahanti, M. Arlitt, C. Williamson, Identifying and discriminating between web and peer-to-peer traffic in the network core, in: Proceedings of WWW Conference, 2007.
22. J. Erman, A. Mahanti, M. Arlitt, Byte me: a case for byte accuracy in traffic classification, in: Proceedings of ACM SIGMETRICS MineNet, June, 2007.
23. A. Soule, K. Salamatian, N. Taft, R. Emilion, K. Papagiannaki, Flow classification by histograms: or how to go on safari in the Internet, in: Proceedings of ACM SIGMETRICS, June, 2004.
24. S. Zander, T. Nguyen, G. Armitage, Self-learning IP traffic classification based on statistical flow characteristics, in: Proceedings of PAM Conference, March, 2005.
25. S. Zander, T. Nguyen, G. Armitage, Automated traffic classification and application identification using machine learning, in: Proceedings of IEEE LCN Conference, November, 2005.
26. J. Erman, A. Mahanti, M. Arlitt, Internet traffic identification using machine learning, in: Proceedings of IEEE GLOBECOM, October, 2006.
27. N. Williams, S. Zander, and G. Armitage A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification ACM SIGCOMM Comput. Commun. Rev. 36 5 2006
28. N. Williams, S. Zander, G. Armitage, Evaluating Machine Learning Methods for Online Game Traffic Identification, CAIA Technical Report, April.
29. N. Williams, S. Zander, G. Armitage, Evaluating Machine Learning Algorithms for Automated Network Application Identification, CAIA Technical Report, April.
30. G. Szabo, D. Orincsay, S. Malomsoky, I. Szabo, On the validation of traffic classification algorithms, in: Proceedings of PAM Conference, April, 2008.
31. H. Kim, K. Claffy, M. Fomenkov, D. Barman, M. Faloutsos, K. Lee, Internet traffic classification demystified: myths, caveats, and the best practices, in: Proceedings of ACM CoNEXT, December, 2008.
32. T. Nguyen, and G. Armitage A survey of techniques for Internet traffic classification using machine learning IEEE Commun. Surv. Tutorials 10 4 2009
33. CoralReef. .
34. P. Barlet-Ros, G. Iannaccone, J. Sanjus-Cuxart, D. Amores-López, J. Solé-Pareta, Load shedding in network monitoring applications, in: Proceedings of USENIX Annual Technical Conference, 2007.
35. OpenDPI, the Open Source version of ipoques DPI software. .
36. Cisco Systems: Sampled NetFlow. .
37. C. Shannon, E. Aben, kc claffy, D. Andersen, The CAIDA Anonymized 2008/2009 Internet Traces- Equinix-Chicago/Equinix-SanJose. .
38. Waikato Internet Traffic Storage (WITS): Auckland VIII trace. http://www.wand.net.nz/wits/auck/8/auckland-viii.php
39. Traffic classification at the Universitat Politcnica de Catalunya (UPC). .
40. J. Quinlan C4. 5: Programs for Machine Learning 1993 Morgan Kaufmann
41. L7-filter. Application layer packet classifier. .
42. M. Canini, W. Li, A. Moore, and R. Bolla GTVS: boosting the collection of application traffic ground truth Proceedings of 1st International Workshop on Traffic Monitoring and Analysis 2009 Springer Aachen, Germany
43. WEKA: data mining software in Java. .
44. P. Barlet-Ros, J. Sole-Pareta, J. Barrantes, E. Codina, and J. Domingo-Pascual SMARTxAC: a passive monitoring and analysis system for high-speed networks Campus-Wide Inform. Syst. 23 4 2006
45. K. Lan, and J. Heidemann A measurement study of correlations of internet flow characteristics Comput. Networks 50 1 2006 46 62 (Pubitemid 41550390)
46. W. Liu Estimating flow length distributions using least square method and maximum likelihood estimation ICCS '07: Proceedings of the 7th International Conference on Computational Science, Part IV 2007 Springer-Verlag 793 796
47. N.V. Chawla, C4.5 and imbalanced data sets: investigating the effect of sampling method, probabilistic estimate, and decision tree structure, in: Proceedings of the ICMLG03 Workshop on Class Imbalances, 2003.
48. Cisco IOS. NetFlow white papers. .
49. H. Pham Handbook of Reliability Engineering 2006 Springer London
50. N. Duffield, C. Lund, M. Thorup, Properties and prediction of flow statistics from sampled packet streams, in: Proceedings of ACM SIGCOMM Internet Measurement Workshop, 2002, pp. 159-171.
51. T. Karagiannis, K. Papagiannaki, M. Faloutsos, BLINC: multilevel traffic classification in the dark, in: Proceedings of ACM SIGCOMM, August, 2005.
52. J. Mai, A. Sridharan, C. Chuah, H. Zang, T. Ye, Impact of packet sampling on portscan detection, IEEE J. Sel. Area Comm. (2006).
53. J. Mai, C. Chuah, A. Sridharan, T. Ye, H. Zang, Is sampled data sufficient for anomaly detection? in: Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement, 2006.
54. I. Paredes-Oliva, P. Barlet-Ros, J. Sole-Pareta, Portscan detection with Sampled NetFlow, in: Proceedings of International Workshop on Traffic Monitoring and Analysis, 2009.
55. G. Androulidakis, V. Chatzigiannakis, S. Papavassiliou, M. Grammatikou, V. Maglaris, Understanding and evaluating the impact of sampling on anomaly detection techniques, in: Military Communications Conference, 2006.
56. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, A. Lakhina, Impact of packet sampling on anomaly detection metrics, in: Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement, 2006.
57. A. Davy, D. Botvich, B. Jennings, On the use of accounting data for QoS-aware IP network planning, in: Proceedings of the 20th International Teletraffic Conference on Managing Traffic Performance in Converged Networks, 2007, pp. 348-360.