An empirical study of morphing on network traffic classification

Qu, B; Zhang, Z; Guo, L; Zhu, X; Meng, D

An empirical study of morphing on network traffic classification

Qu, B Zhang, Z Guo, L Zhu, X Meng, D

Permalink

Publisher:: IEEE
Publication Type:: Conference Proceeding
Citation:: Communications and Networking in China (CHINACOM), 2012 7th International ICST Conference on, 2012, pp. 227 - 232
Issue Date:: 2012-01

Closed Access

	Filename	Description	Size
	2012004403OK.pdf	Published version	183.77 kB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	Qu, B	en_US
dc.contributor.author	Zhang, Z	en_US
dc.contributor.author	Guo, L	en_US
dc.contributor.author	Zhu, X	en_US
dc.contributor.author	Meng, D	en_US
dc.contributor.editor	NA	en_US
dc.date	2012-08-10	en_US
dc.date.issued	2012-01	en_US
dc.identifier.citation	Communications and Networking in China (CHINACOM), 2012 7th International ICST Conference on, 2012, pp. 227 - 232	en_US
dc.identifier.isbn	978-1-4673-2698-8	en_US
dc.identifier.uri	http://hdl.handle.net/10453/31743
dc.description.abstract	Network morphing aims at masking traffic to degrade the performance of traffic identification and classification. Several morphing strategies have been proposed as promising approaches, very few works, however, have investigated their impact on the actual traffic classification performance. This work sets out to fulfill this gap from an empirical study point of view. It takes into account different morphing strategies exerted on packet size and/or inter-arrival time. The results show that not all morphing strategies can effectively obfuscate traffic classification. Different morphing strategies perform distinctively, among which the integration of packet size and inter arrival time morphing is the best, and the packet size based method is the worst. The three classifiers also exhibit distinct robustness to the morphing, with C4.5 being the most robust and Naive Bayes being the weakest. In addition, our study shows that classifiers can learn nontrivial information merely from the traffic direction patterns, which partially explains the weakness of packet size based morphing methods.	en_US
dc.publisher	IEEE	en_US
dc.relation.ispartof	Communications and Networking in China (CHINACOM), 2012 7th International ICST Conference on	en_US
dc.relation.ispartof	International Conference on Communications and Networking in China (CHINACOM)	en_US
dc.relation.isbasedon	10.1109/ChinaCom.2012.6417481	en_US
dc.rights	© 2012 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.	en_US
dc.title	An empirical study of morphing on network traffic classification	en_US
dc.type	Conference Proceeding
utslib.location	Piscataway, NJ	en_US
utslib.location.activity	Kun Ming	en_US
utslib.for	0805 Distributed Computing	en_US
dc.location.activity	Kun Ming
pubs.embargo.period	Not known	en_US
pubs.organisational-group	/University of Technology Sydney
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	/University of Technology Sydney/Strength - AAI - Advanced Analytics Institute Research Centre
utslib.copyright.status	closed_access
pubs.consider-herdc	true	en_US
pubs.place-of-publication	Piscataway, NJ	en_US
pubs.start-date	2012-08-10	en_US

Abstract:

Network morphing aims at masking traffic to degrade the performance of traffic identification and classification. Several morphing strategies have been proposed as promising approaches, very few works, however, have investigated their impact on the actual traffic classification performance. This work sets out to fulfill this gap from an empirical study point of view. It takes into account different morphing strategies exerted on packet size and/or inter-arrival time. The results show that not all morphing strategies can effectively obfuscate traffic classification. Different morphing strategies perform distinctively, among which the integration of packet size and inter arrival time morphing is the best, and the packet size based method is the worst. The three classifiers also exhibit distinct robustness to the morphing, with C4.5 being the most robust and Naive Bayes being the weakest. In addition, our study shows that classifiers can learn nontrivial information merely from the traffic direction patterns, which partially explains the weakness of packet size based morphing methods.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/31743