An empirical study of morphing on network traffic classification

Publication Type:
Conference Proceeding
Communications and Networking in China (CHINACOM), 2012 7th International ICST Conference on, 2012, pp. 227 - 232
Issue Date:
Filename Description Size
Thumbnail2012004403OK.pdf Published version183.77 kB
Adobe PDF
Full metadata record
Network morphing aims at masking traffic to degrade the performance of traffic identification and classification. Several morphing strategies have been proposed as promising approaches, very few works, however, have investigated their impact on the actual traffic classification performance. This work sets out to fulfill this gap from an empirical study point of view. It takes into account different morphing strategies exerted on packet size and/or inter-arrival time. The results show that not all morphing strategies can effectively obfuscate traffic classification. Different morphing strategies perform distinctively, among which the integration of packet size and inter arrival time morphing is the best, and the packet size based method is the worst. The three classifiers also exhibit distinct robustness to the morphing, with C4.5 being the most robust and Naive Bayes being the weakest. In addition, our study shows that classifiers can learn nontrivial information merely from the traffic direction patterns, which partially explains the weakness of packet size based morphing methods.
Please use this identifier to cite or link to this item: