Improving signature quality for network application identification

作     者：Justin Tharp Sang C·Suh Hyeonkoo Cho Jinoh Kim 

作者机构：Department of Computer Science Texas A&M University-Commerce P.O. Box 3011 Commerce TX 75429 USA Sysmate Inc. 41 Yuseong-daero 1184 beon-gil Yuseong-gu Daejeon 34109 North Korea 

出 版 物：《Digital Communications and Networks》 (数字通信与网络（英文版）)

年 卷 期：2019年第5卷第3期

页      面：139-146页

核心收录：

学科分类：0809[工学-电子科学与技术（可授工学、理学学位）] 08[工学] 

基　　金：MOTIE/KEIT  (10041548) 

主　　题：Network application identification Application signatures Pairwise merging Signature reduction Explicit string patterns 

摘      要：Network application identification is one of the core elements in network operations and management to provide enhanced network service and security. For accurate identification, an approach using common patterns called signatures is widely used to compensate the limitations of the traditional transport-layer port-based classification. However, our simulation results indicate that using the signatures generated from a set of well known algorithms may lead to very poor identification performance, with less than 60% of true positives even in an optimal case. To improve the quality of signatures, we present a technique in this paper, which consists of two steps:(i) pairwise merging to consider every possible combination of the initially collected signatures to reduce their specificity that causes the signatures to be less common;and (ii) signature reduction to identify effective signatures with greater importance from a large set of signatures produced in the merging step, so as to manage the space/time complexity in the identification process for greater scalability. Our experimental results show that the proposed technique can dramatically improve the performance, even with a small number of signatures (e.g., 95% true positives rate with 30 signatures per application) which is more compact than the initial signature set.