Detail publikace

Traffic Classification and Application Identification in Network Forensics

PLUSKAL, J. LICHTNER, O. RYŠAVÝ, O.

Originální název

Traffic Classification and Application Identification in Network Forensics

Typ

článek ve sborníku ve WoS nebo Scopus

Jazyk

angličtina

Originální abstrakt

Network traffic classification is an absolute necessity for network monitoring, security analysis, and digital forensics. Without accurate traffic classification, computation demands on analysis of all IP flows are enormous. Classification can also reduce the number of flows that need to be analyzed, prioritize, and order them for an investigator to analyze the most forensically significant first. This paper presents an automatic feature elimination method based on a feature correlation matrix. Furthermore, we compare two algorithms adapted from literature, that offer high accuracy and acceptable performance, and our algorithm -- Enhanced Statistical Protocol Identification (ESPI). Each of these algorithms is used with a subset of features that best suits it. We evaluate these algorithms on their ability to identify application layer protocols and additionally applications themselves. Experiments show that the Random Forest based classifier yields the most promising results, whereas our algorithm provides an interesting tradeoff between higher performance and slightly lower accuracy.

Klíčová slova

network forensics, network traffic classification, statistical protocol identification, application identification, application protocol identification, machine learning, random forests, Bayesian classifier

Autoři

PLUSKAL, J.; LICHTNER, O.; RYŠAVÝ, O.

Vydáno

3. 1. 2018

Nakladatel

Springer International Publishing

Místo

New Delhi

ISBN

978-3-319-99277-8

Kniha

Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics

ISSN

1868-4238

Periodikum

IFIP Advances in Information and Communication Technology

Ročník

532

Číslo

1

Stát

Švýcarská konfederace

Strany od

161

Strany do

181

Strany počet

21

BibTex

@inproceedings{BUT154990,
  author="Jan {Pluskal} and Ondrej {Lichtner} and Ondřej {Ryšavý}",
  title="Traffic Classification and Application Identification in Network Forensics",
  booktitle="Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics",
  year="2018",
  journal="IFIP Advances in Information and Communication Technology",
  volume="532",
  number="1",
  pages="161--181",
  publisher="Springer International Publishing",
  address="New Delhi",
  doi="10.1007/978-3-319-99277-8",
  isbn="978-3-319-99277-8",
  issn="1868-4238"
}