Behavior Signature for Fine-grained Traffic Identification

Abstract: With the rapid development of the Internet and a vigorous emergence of new applications, traffic identification has become a key issue for efficient network management. Although various methods have been proposed, there are still several limitations to achieving fine-grained and application-level traffic identification. In this paper, we propose a new signature model called a behavior signature for Internet traffic identification that utilizes the inter-flow relation of application traffic. The proposed behavior signature is a unique traffic behavior pattern appearing in the first few packets of plural traffic flows when a specific function is conducted by an application with a combination of various optional traffic features. This is in contrast to other existing signature models that usually focus on a singular packet or flow for feature extraction and traffic identification. We proved the feasibility and applicability of the proposed behavior signature by developing an extraction and identification algorithm and by conducting experiments on several popular applications