EARLY RECOGNITION OF INTERNET TRAFFIC BASED ON SIGNATURE INSPECTION

• 作 者: Niu Xiaona Guo Yunfei Zhang Ji
• 机 构: National Digital Switching System Engineering & Technology Research Center NDSC
• 出 处: 电子科学学刊（英文版）
• 发表日期: 2004年期
• 关键词: Traffic classification Packet sampling Payload signature inspection Early recogn
• 基金项目: grant from the Major State Basic Research Development Program of China

The accurate and efficient classification of Internet traffic is the first and key step to accurate traffic management,network security and traffic analysis.The classic ways to identify flows is either inaccurate or inefficient,which are not suitable to be applied to real-time online classification.In this paper,we originally presented an early recognition method named Early Recognition Based on Deep Packet Inspection (ERBDPI) based on deep packet inspection,after analyzing the distribution of payload signature between packets of a flow in detail.The basic concept of ERBDPI is classifying flows based on the payload signature of their first some packets,so that we can identify traffic at the beginning of a flow connection.We compared the performance of ERBDPI with that of traditional sampling methods both synthetically and using real-world traffic traces.The result shows that ERBDPI can get a higher classification accuracy with a lower packet sampling rate,which makes it suitable to be applied to accurate real-time classification in high-speed links.