Efficient network traffic classifier: composition approach

Abstract

Internet Service Providers (ISP) are eagerly looking for obtaining metadata from the traffic that they carry. The obtained metadata is a valuable asset for ISPs to enhance their functionality and reduce their operational cost. Classifying a network traffic based on the application (app) that generates the traffic is vital for today’s ISPs and network providers. They use Network Traffic Classification (NTC) to improve many aspects of their network like security and resource allocation. In addition, NTC enables the ISPs to offer new services to their customers and end users. However, NTC faces a big challenge due to the high dynamic Internet ecosystem. Thousands apps are published daily[1] and NTC needs to be updated with their footprint. Moreover some of the existing apps do not follow IANA[2] port number assignment list to use port number which provides more complexity to the ecosystem. Besides, encryption is a trend to secure end-to-end communication and it makes performing NTC hard for those classifiers who relay on information in users payload. Last but not least the volume of traffic that NTC has to investigate is drastically increasing. Therefore, NTC should be fast enough to do the classification on-line which is an essential requirement for many NTC applications. in this thesis, I propose Chain as a novel algorithm to do NTC. Chain sequentially investigates different aspects of a network traffic and brings a significant improvement in tradeoff between classification performance and speed. Besides, it shows a great flexibility to adopt to the new network traffic due to its modularity design. I have implemented Chain in Traffic Identification Engine (TIE) [3] platform and have evaluated its performance with data set [4] which is published by CBA research group at Technical University of Catalunya. Following I have developed a platform named GTEngin to collect ground truth driven from mobile apps and then I have reevaluated the performance of my proposal with the new ground truth. In addition, I participated in an investigation carrying out on mobile Internet to study the possibility of improving my proposal performance in mobile ecosystem.Consequently, I leverage the result of the investigation and measure the enhancement of my proposal performance which achieved accordingly.