Publication detail

Traffic Classification and Application Identification in Network Forensics

PLUSKAL, J. LICHTNER, O. RYŠAVÝ, O.

Original Title

Traffic Classification and Application Identification in Network Forensics

Type

conference paper

Language

English

Original Abstract

Network traffic classification is an absolute necessity for network monitoring, security analysis, and digital forensics. Without accurate traffic classification, computation demands on analysis of all IP flows are enormous. Classification can also reduce the number of flows that need to be analyzed, prioritize, and order them for an investigator to analyze the most forensically significant first. This paper presents an automatic feature elimination method based on a feature correlation matrix. Furthermore, we compare two algorithms adapted from literature, that offer high accuracy and acceptable performance, and our algorithm -- Enhanced Statistical Protocol Identification (ESPI). Each of these algorithms is used with a subset of features that best suits it. We evaluate these algorithms on their ability to identify application layer protocols and additionally applications themselves. Experiments show that the Random Forest based classifier yields the most promising results, whereas our algorithm provides an interesting tradeoff between higher performance and slightly lower accuracy.

Keywords

network forensics, network traffic classification, statistical protocol identification, application identification, application protocol identification, machine learning, random forests, Bayesian classifier

Authors

PLUSKAL, J.; LICHTNER, O.; RYŠAVÝ, O.

Released

3. 1. 2018

Publisher

Springer International Publishing

Location

New Delhi

ISBN

978-3-319-99277-8

Book

Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics

ISBN

1868-4238

Periodical

IFIP Advances in Information and Communication Technology

Year of study

532

Number

1

State

Swiss Confederation

Pages from

161

Pages to

181

Pages count

21

BibTex

@inproceedings{BUT154990,
  author="Jan {Pluskal} and Ondrej {Lichtner} and Ondřej {Ryšavý}",
  title="Traffic Classification and Application Identification in Network Forensics",
  booktitle="Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics",
  year="2018",
  journal="IFIP Advances in Information and Communication Technology",
  volume="532",
  number="1",
  pages="161--181",
  publisher="Springer International Publishing",
  address="New Delhi",
  doi="10.1007/978-3-319-99277-8",
  isbn="978-3-319-99277-8",
  issn="1868-4238"
}