Independent comparison of popular DPI tools for traffic classification

Computer Networks

Volumn 76, Issue , 2015, Pages 75-89

  Bujlow, Tomasz ^a   Carela Español, Valentín ^b   Barlet Ros, Pere ^b  

^a AALBORG UNIVERSITY   (Denmark)

^b UNIVERSITAT POLITÈCNICA DE CATALUNYA   (Spain)

Author keywords

Deep packet inspection; L7 filter; Libprotoident; NBAR; nDPI; PACE

Indexed keywords

INTERNET PROTOCOLS; PACKET NETWORKS; TELECOMMUNICATION TRAFFIC; WEB SERVICES;

DEEP PACKET INSPECTION; L7 FILTERS; LIBPROTOIDENT; NBAR; NDPI; PACE;

CLASSIFICATION (OF INFORMATION);

EID: 84911861083     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2014.11.001     Document Type: Article

References (52)

1. NBAR2 or Next Generation NBAR - Cisco Systems, 2013. 〈http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6558/ ps6616/qa-c67-697963.html〉.
2. PACE - Network Analysis with Layer-7 Deep Packet Inspection, 2013. 〈http://www.ipoque.com/en/products/pace〉.
3. Qosmos - Deep Packet Inspection and Metadata Engine, 2013. 〈http://www.qosmos.com/products/deep-packet-inspection-engine/〉.
4. Paloalto Networks, 2013. 〈https://www.paloaltonetworks.com/〉.
5. A. Dainotti, A. Pescapè, K.C. Claffy, Issues and future directions in traffic classification, IEEE Netw. 26 (1) (2012) 35-40,http://dx.doi.org/10.1109/MNET.2012.613585.
6. J. Khalife, A. Hajjar, J. Díaz-Verdejo, Performance of OpenDPI in identifying sampled network traffic, J. Netw. 8 (1) (2013) 71-81, http://dx.doi.org/10.4304/jnw.8.1.71-81.
7. J. Khalife, A. Hajjar, J. Díaz-Verdejo, On the performance of OpenDPI in identifying P2P truncated flows, in: AP2PS 2011, The Third International Conference on Advances in P2P Systems, IARIA, Lisbon, Portugal, 2011, pp. 79-84.
8. S. Alcock, R. Nelson, Libprotoident: Traffic Classification Using Lightweight Packet Inspection, Tech. Rep., University of Waikato, August 2012. 〈http://www.wand.net.nz/publications/lpireport〉.
9. Alcock Shane, Nelson Richard, Measuring the accuracy of opensource payload-based traffic classifiers using popular Internet applications, in: IEEE Workshop on Network Measurements (WNM), the 38th IEEE Conference on Local Computer Networks (LCN), IEEE, Sydney, Australia, 2013.
10. C. Shen, L. Huang, On detection accuracy of L7-filter and OpenDPI, in: 2012 Third International Conference on Networking and Distributed Computing (ICNDC), IEEE, Hangzhou, China, 2012, pp. 119-123, http://dx.doi.org/10.1109/ICNDC.2012.36.
11. CAIDA Internet Data - Passive Data Sources, 2012. 〈http://www.caida.org/data/passive/〉.
12. CAIDA Internet Data - Internet Measurement Data Catalog (IMDC), 2012. 〈http://www.caida.org/projects/trends/imdc/〉.
13. MAWI Working Group Traffic Archive, 2013. 〈http://mawi.wide.ad.jp/mawi/〉.
14. CRAWDAD, 2013. 〈http://crawdad.cs.dartmouth.edu/〉.
15. WITS: Waikato Internet Traffic Storage, 2013. 〈http://www.wand.net.nz/wits/〉.
16. G. Szabó, D. Orincsay, S. Malomsoky, I. Szabó, On the validation of traffic classification algorithms, in: Proceedings of the 9th International Conference on Passive and Active network Measurement PAM 2008, Springer, Berlin Heidelberg, Cleveland, Ohio, USA, 2008, pp. 72-81, http://dx.doi.org/10.1007/978-3-540-79232-1-8.
17. F. Gringoli, L. Salgarelli, M. Dusi, N. Cascarano, F. Risso, K.C. Claffy, Gt: picking up the truth from the ground for internet traffic, ACM SIGCOMM Comput. Commun. Rev. 39 (5) (2009) 12-18, http://dx.doi.org/10.1145/1629607.1629610.
18. M. Canini, W. Li, A.W. Moore, R. Bolla, GTVS: boosting the collection of application traffic ground truth, in: Proceedings of the First International Workshop on Traffic Monitoring and Analysis, TMA 2009, Springer, Berlin Heidelberg, Aachen, Germany, 2009, pp. 54-63, http://dx.doi.org/10.1007/978-3-642-01645-5-7.
19. V. Carela-Español, T. Bujlow, P. Barlet-Ros, Is our ground-truth for traffic classification reliable?, in: Proceedings of the 15th Passive and Active Measurement Conference (PAM 2014), Proceedings Series: Lecture Notes in Computer Science, vol 8362, Springer International Publishing Switzerland, Los Angeles, USA, 2014, pp. 98-108, http://dx.doi.org/10.1007/978-3-319-04918-2-10.
20. T. Bujlow, K. Balachandran, T. Riaz, J.M. Pedersen, Volunteer-based system for classification of traffic in computer networks, in: Proceedings of the 19th Telecommunications Forum TELFOR 2011, Springer, Belgrade, Serbia, 2011, pp. 210-213, http://dx.doi.org/10.1109/TELFOR.2011.6143528.
21. L. Deri, M. Martinelli, T. Bujlow, A. Cardigliano, nDPI: open-source high-speed deep packet inspection, in: Proceedings of the 10th International Wireless Communications & Mobile Computing Conference 2014 (IWCMC 2014), IEEE, Nicosia, Cyprus, 2014, pp. 617-622, http://dx.doi.org/10.1109/IWCMC.2014.6906427.
22. Daniele De Sensi, Marco Danelutto, Luca Deri, DPI Over Commodity Hardware: Implementation of a Scalable Framework using FastFlow, Master's Thesis, Universitá di Pisa, Italy, 2012. 〈http://etd.adm.unipi.it/t/etd-02042013-101033/〉.
23. M. Ott, Intelligent Network Based Application Recognition, uS Patent 6,961,770, November 2005.
24. Application Layer Packet Classifier for Linux, 2009. 〈http://l7-filter.sourceforge.net/〉.
25. T. Bujlow, K. Balachandran, S. Ligaard Nørgaard Hald, T. Riaz, J. Myrup Pedersen, Volunteer-based system for research on the Internet traffic, TELFOR J. 4 (1) (2012) 2-7. 〈http://journal.telfor.rs/Published/Vol4No1/Vol4No1.aspx〉.
26. Volunteer-Based System for Research on the Internet, 2012. 〈http://vbsi.sourceforge.net/〉.
27. w3schools.com, OS Platform Statistics, 2013. 〈http://www.w3schools.com/browsers/browsers-os.asp〉.
28. Palo Alto Networks. Application Usage and Threat Report, 2013. 〈https://www.paloaltonetworks.com/resources/whitepapers/application-usage-and-threat-report.html〉.
29. CNET, P2P & File-Sharing Software, 2013. 〈http://download.cnet.com/windows/p2p-file-sharing-software/?tag=nav〉.
30. CNET, FTP Software, 2013. 〈http://download.cnet.com/windows/ftp-software/?tag=mncol;sort&rpp=30&sort=popularity〉.
31. Top 15 Most Popular File Sharing Websites, 2013. 〈http://www.ebizmba.com/articles/file-sharing-websites〉.
32. Top 15 Most Popular Video Websites - December 2013, 2013. 〈http://www.ebizmba.com/articles/video-websites〉.
33. Popular on YouTube - YouTube, 2013. 〈http://www.youtube.com/charts/videos-views?t=a〉.
34. w3schools.com, Browser Statistics, 2013. 〈http://www.w3schools.com/browsers/browsers-stats.asp〉.
35. Alexa Top 500 Global Sites, 2013. 〈http://www.alexa.com/topsites〉.
36. Top 15 Most Popular Websites - December 2013, 2013. 〈http://www.ebizmba.com/articles/most-popular-websites〉.
37. Quantcast - Top Ranking International Websites, 2013. 〈https://www.quantcast.com/top-sites〉.
38. Top 15 Most Popular Search Engines - eBizMBA, 2013. 〈http://www.ebizmba.com/articles/search-engines〉.
39. T. Bujlow, V. Carela-Español, P. Barlet-Ros, Extended Independent Comparison of Popular Deep Packet Inspection (DPI) Tools for Traffic Classification, Tech. Rep., Department of Computer Architecture (DAC), Universitat Politècnica de Catalunya (UPC), January 2014. 〈https://www.ac.upc.edu/app/research-reports/html/research-center-index-CBA-2014,en.html〉.
40. Email Client Market Share and Popularity - October 2013, 2013. 〈http://emailclientmarketshare.com/〉.
41. DFC Intelligence, 2013. 〈http://www.dfcint.com/wp/?p=343〉.
42. V. Carela-Español, P. Barlet-Ros, A. Cabellos-Aparicio, J. Solé-Pareta, Analysis of the impact of sampling on NetFlow traffic classification, Comput. Netw. 55 (2011) 1083-1099, http://dx.doi.org/10.1016/j.comnet.2010.11.00.
43. PMACCT Project: IP Accounting Iconoclasm, 2013. 〈http://www.pmacct.net/〉.
44. Traffic Classification at the Universitat Politècnica de Catalunya (UPC)., 2014. 〈http://www.cba.upc.edu/monitoring/traffic-classification〉.
45. M. Dusi, F. Gringoli, L. Salgarelli, Quantifying the accuracy of the ground truth associated with Internet traffic traces, Comput. Netw. 55 (5) (2011) 1158-1167, http://dx.doi.org/10.1016/j.comnet.2010.11.006.
46. H. Kim, K.C. Claffy, M. Fomenkov, D. Barman, M. Faloutsos, K. Lee, Internet traffic classification demystified: myths, caveats, and the best practices, in: Proceedings of the 2008 ACM CoNEXT Conference, ACM, New York, Madrid, Spain, 2008, p. 8, http://dx.doi.org/10.1145/1544012.1544023.
47. K. Fukuda, Difficulties of identifying application type in backbone traffic, in: 2010 International Conference on Network and Service Management (CNSM), IEEE, Niagara Falls, Ontario, Canada, 2010, pp. 358-361, http://dx.doi.org/10.1109/CNSM.2010.5691234.
48. S. Gebert, R. Pries, D. Schlosser, K. Heck, Internet access traffic measurement and analysis, in: Proceedings of the 4th International Conference on Traffic Monitoring and Analysis (TMA'12), Springer, Berlin Heidelberg, Vienna, Austria, 2012, pp. 29-42, http://dx.doi.org/10.1007/978-3-642-28534-9-3.
49. P. Megyesi, S. Molnár, Finding typical internet user behaviors, in: Proceedings of the 18th EUNICE Conference on Information and Communications Technologies (EUNICE 2012): Information and Communication Technologies, Springer, Berlin Heidelberg, Budapest, Hungary, 2012, pp. 321-327, http://dx.doi.org/10.1007/978-3-642-32808-4-29.
50. G. Aceto, A. Dainotti, W. De Donato, A. Pescapé, PortLoad: taking the best of two worlds in traffic classification, in: INFOCOM IEEE Conference on Computer Communications Workshops, 2010, IEEE, San Diego, California, USA, 2010, pp. 1-5, http://dx.doi.org/10.1109/INFCOMW.2010.5466645.
51. R. Goss, R. Botha, Deep packet inspection - fear of the unknown, in: Information Security for South Africa (ISSA), 2010, IEEE, Sandton, Johannesburg, South Africa, 2010, pp. 1-5, http://dx.doi.org/10.1109/ISSA.2010.5588278.
52. S. Valenti, D. Rossi, A. Dainotti, A. Pescapè, A. Finamore, M. Mellia, Reviewing traffic classification, in: Data Traffic Monitoring and Analysis, Springer, Berlin Heidelberg, 2013, pp. 123-147, http://dx.doi.org/10.1007/978-3-642-36784-7-6.