Traffic Classification based on Visualization 0101001111110010011011010101010100101101110011111001010011101101011111010110111110011101111111100010001001110010000111100011100011101110111011110110100111010010101010011111010100010111001111001111100101001110110101111101011011111001110111 Zhibin Yu Realtime Image Processing & Telecommunication Lab. Kyungpook National University South Korea December 8th, 2011
Overview 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 Person A Person B face recognition P2P Flow A Flow face A HTTP Flow B Flow face B FTP Flow C Flow face C …… Network traffic face recognition Figure A Is that possible to use face recognition technology to classify network traffic? 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 2 2
Contents 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Introduction • Related work • Proposed algorithm • Evaluation • Conclusion 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 3 3
Introduction 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 Pattern Input traffic Image recognition flows enhancement (PCA) Normalization Display 2-D of packet size Results images and interval Figure B Flow chart 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 4 4
Related Work 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Port-based Approaches – Fast but unreliable • Signature-based approaches – Accurate but inflexible • Statistical-based approaches – weak in small flows • Machine Learning Approaches – Accurate but time costly • Traffic Classification Metric 2 TP F = 2 TP FN FP + + – where TP is true positive, FN is false negative and FP is false positive. 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 5 5
Proposed Method (1/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Feature selection – Packet size – Packet inter-arrival time Figure C: Cumulative Distribution of Packet Size and Packet Inter-arrival time using our experiment dataset 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 6 6
Proposed Method (2/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Image Normalization – Definition Y 512*512 image Packet Inter- arrival time X Packet size Packet _ Interval Packet _ size a Y 512 * ( ) X 512 * = = Max _ Interval MTU – MTU=1500 – Max_Interval=3600s – a=0.1 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 7 7
Proposed Method (3/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Image Normaliztion – Initialized Images (a) (b) (c) (d) Figure D: Four local images generated by FTP-data and OICQ flows. (a) FTP-data1. (b)FTP-data2. (c) OICQ1. (d)OICQ2. 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 8 8
Proposed Method (4/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Image enhancement – Mountain clustering and visualization 2 N || a a || − b i M ( exp( ) ) ∑ = − a 2 2 σ i 1 = M B 255 * ( a ) a = M max – N is the total number of packets in this flow – M a is the mountain height of point a calculated by equation 1 – b is the parameter which controls the difference between peak and plain – B a is the brightness value of point a 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 9 9
Proposed Method (5/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Image enhancement – Mountain clustering (a) (b) (c) Figure E: Image enhancement after mountain clustering. (a) Original image. (b)Mountain clustering value. (c) Image after enhancement when b=0.3 σ =2 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 10 10
Evaluation (1/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Evaluation – Data Description Average flow size Average interval Average packet size Traffic name (Kbytes) (Seconds) (Bytes) HTTP 37.9 0.759 646 FTP 7.64 11.621 84 FTP-data 21386.7 0.0666 576 OICQ 18.9 3.531 200 (Chatting) POP3 35.3 0.246 317 SMTP 19.9 0.0835 464 Web-download 21734.4 0.0425 1142 PPStream 1911.6 0.284 371 (P2PTV) Table 1: Data description 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 11 11
Evaluation (2/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Perfermance – Comparison with different parameters (c) (b) (d) (a) (e) (g) (f) Figure F: (a) Initialized image generated by a PPS flow (11.4MB). (b) b=0.1 σ =4. (c) b=0.2 σ =4. (d) b=0.5 σ =4. (e) b=0.2 σ =1 (f) b= 0.2 σ =2 (g) b=0.2 σ =4 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 12 12
Evaluation (3/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Performance – Comparison with different flow size (a) (b) (c) (d) Figure G: Performance between different flow size (a) Initialized images generated by an elephent FTP-data flow(53,401KB). (b) Initialized images generated by a mice FTP-data flow (4.43KB). (c) Image (a) after enhancement with parameter b=0.3 σ =2. (d) Image (b) after enhancement with parameter b=0.3 σ =2 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 13 13
Evaluation (4/5) 010100111111001001101101010101010010110111001111100101001110110101111101011011111001110111111110001000100111001000011110001110001110111011101111011010011101001010101001111101010001011100111100111110010100111011010111110101101111100111011111111000 • Perfermance – Performance on encryption detection – 386 ftp-data flows based on SFTP protocol using SSH2 are tested 350 300 250 200 150 (a) 100 50 0 (c) (b) Figure H: Performance of encryption traffic classification (a) An image generated from an SSH flow(13.4MB) with parameter b=0.3 σ =2. (b) An image generated from an FTP-data flow(13.0MB) with parameter b=0.3 σ =2. (c) Recognition result by PCA 16/12/11 Realtime Image Pr Processing ng & Te Telecommuni unication n Lab. 14 14
Recommend
More recommend
