Traffic classification using visual motifs: an empirical evaluation

In this paper, we explore the effectiveness of using graphical meth-ods for isolating the differences between common application protocols— both in their transient and steady-state behavior. Specifically, we take advantage of the observation that many Internet application protocols proscribe a very specific series of client/server interac-tions that are clearly visible in the sizes and timing of packets pro-duced at the network layer and below. We show how so-called “vi-sual motifs ” built on these features can be used to assist a human operator to recognize application protocols in unidentified traffic. From a practical point of view, visual traffic classification can be used, for example, for anomaly detection to verify that all traffic to a web server on TCP port 80 does indeed exhibit the characteristic behavior patterns of HTTP, or for misuse detection to find unau-thorized servers or to identify traffic generated by prohibited appli-cations. We present our technique for building a classifier based on the notion of visual motifs, and report on our experience us-ing this technique to automatically classify on-the-wire behavioral patterns from network flow data collected from a campus network. Specifically, we analyze over 1 billion flows corresponding to over 5 million sessions on nearly 200 distinct ports, and show that our approach achieves high recall and precision