1. Traffic Classification through Simple Statistical Fingerprinting M. Crotti, M. Dusi, F. Gringoli, L. Salgarelli ACM SIGCOMM Computer Communication Review, 2007 Networking Journal Club 9th July 2010

2. 1 Outline 1.Introduction 2.(Related Work) 3.Protocol Fingerprints 4.Classification Algorithm 5.Experimental Analysis 6.Discussion 7.Future work and Conclusions

3. 2 Introduction  Motivation: Traffic classification: Allocation, control and management of resources Intrusion detection QoS-aware mechanisms …  Methods: Port-based DPI …

4. 3 Protocol Fingerprints  TCP flows (HTTP, SMTP, SSH, …)  Unidirectional  Statistical properties of the flows: Size of packets Inter-arrival times Order of arrivals  PDF i : Probability density function of packet i-th on the plane (size,interarrival)  PDF: vector of L PDF i

5. 4 Protocol Fingerprints  Anomaly score: “how statistically far” an unknown flow F is from a given protocol PDF  To smooth PDF i use Gaussian filter: M i  Preliminary anomaly score:  Anomaly score:  Anomaly threshold: upper bound of the anomaly score to be considered of this protocol

6. 5 Classification algorithm

7. 6 a.Collect traffic traces (training set) b.Pre-classify traces (the accuracy of the tool is critical) c.Build protocol fingerprints d.Start the classification engine e.Periodically, update the fingerprints  Low computational load

8. 7 Experimental Analysis  Traffic traces collected in campus: 24 Mbps link  >60% TCP port: 80, 110, 25  >40GB, 20K flows, of HTTP, POP3, SMTP  Performance parameters: Hit rate False positive rate  4 th packet

9. 8 Sensitivity to parameters

10. 9 Discussion  Accuracy of training sets  Complexity of the technique  Fclient or Fserver? Where’s the classifier?  On the precision of the measuring devices

11. 10 Future Work  Application to a larger data set: VoIP, P2P…  Behavior in different networks  How does the classifier respond to imprecise training set?  Complexity of the algorithm: memory occupation amenability to HW-assisted implementation computational costs of the training phase