Practical and Configurable Network Traffic Classification Using Probabilistic Machine Learning
Network traffic classification that is widely applicable and highly accurate is valuable for many network security and management tasks. A flexible and easily configurable classification framework is ideal, as it can be customized for use in a wide variety of networks. In this paper, we propose a highly configurable and flexible machine learning traffic classification method that relies only on statistics of sequences of packets to distinguish known, or approved, traffic from unknown traffic. Our method is based on likelihood estimation, provides a measure of certainty for classification decisions, and can classify traffic at adjustable certainty levels. Our classification method can also be applied in different classification scenarios, each prioritizing a different classification goal. We demonstrate how our classification scheme and all its configurations perform well on real-world traffic from a high performance computing network environment.
Code (1)
Tasks
BIG-bench Machine LearningClassificationManagementTraffic ClassificationSimilar Papers 제목 키워드 기반
Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic
Website fingerprinting attack is an extensively studied technique used in a web browser to analyze traffic patterns and thus infer confidential information about users. Several website fingerprinting attacks based on mac…
Website Fingerprinting AttacksFlow-Packet Hybrid Traffic Classification for Class-Aware Network Routing
Network traffic classification using machine learning techniques has been widely studied. Most existing schemes classify entire traffic flows, but there are major limitations to their practicality. At a network router, t…
BIG-bench Machine LearningClassificationGeneral ClassificationTraffic ClassificationBeyond Measurement Metrics: A Human-Centered Framework for Semantic Validation of Network Traffic Classification
Machine learning (ML) has become the dominant approach for network traffic classification, achieving very high predictive performance. However, a model is only valuable if it learns semantically meaningful and trustworth…
Evasion-Resilient Detection of DNS-over-HTTPS Data Exfiltration: A Practical Evaluation and Toolkit
The purpose of this project is to assess how well defenders can detect DNS-over-HTTPS (DoH) file exfiltration, and which evasion strategies can be used by attackers. While providing a reproducible toolkit to generate, in…
PacketCLIP: Multi-Modal Embedding of Network Traffic and Language for Cybersecurity Reasoning
Traffic classification is vital for cybersecurity, yet encrypted traffic poses significant challenges. We present PacketCLIP, a multi-modal framework combining packet data with natural language semantics through contrast…
Anomaly DetectionClassificationGraph Neural NetworkIntrusion Detection+2