Publication Details

Traffic Classification and Application Identification in Network Forensics

PLUSKAL, J.; LICHTNER, O.; RYŠAVÝ, O. Traffic Classification and Application Identification in Network Forensics. In Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics. IFIP Advances in Information and Communication Technology. New Delhi: Springer International Publishing, 2018. p. 161-181. ISBN: 978-3-319-99277-8. ISSN: 1868-4238.
Czech title
Klasifikace síťového provozu i komunikujících aplikací v síťové forenzní analýze
Type
conference paper
Language
English
Authors
Keywords

network forensics, network traffic classification, statistical protocol identification, application identification, application protocol identification, machine learning, random forests, Bayesian classifier

Abstract

Network traffic classification is an absolute necessity for network monitoring, security analysis, and digital forensics. Without accurate traffic classification, computation demands on analysis of all IP flows are enormous. Classification can also reduce the number of flows that need to be analyzed, prioritize, and order them for an investigator to analyze the most forensically significant first. This paper presents an automatic feature elimination method based on a feature correlation matrix. Furthermore, we compare two algorithms adapted from literature, that offer high accuracy and acceptable performance, and our algorithm -- Enhanced Statistical Protocol Identification (ESPI). Each of these algorithms is used with a subset of features that best suits it. We evaluate these algorithms on their ability to identify application layer protocols and additionally applications themselves. Experiments show that the Random Forest based classifier yields the most promising results, whereas our algorithm provides an interesting tradeoff between higher performance and slightly lower accuracy.

Published
2018
Pages
161–181
Journal
IFIP Advances in Information and Communication Technology, vol. 532, no. 1, ISSN 1868-4238
Proceedings
Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics
ISBN
978-3-319-99277-8
Publisher
Springer International Publishing
Place
New Delhi
DOI
UT WoS
000475838900010
EID Scopus
BibTeX
@inproceedings{BUT154990,
  author="Jan {Pluskal} and Ondrej {Lichtner} and Ondřej {Ryšavý}",
  title="Traffic Classification and Application Identification in Network Forensics",
  booktitle="Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics",
  year="2018",
  journal="IFIP Advances in Information and Communication Technology",
  volume="532",
  number="1",
  pages="161--181",
  publisher="Springer International Publishing",
  address="New Delhi",
  doi="10.1007/978-3-319-99277-8",
  isbn="978-3-319-99277-8",
  issn="1868-4238"
}
Back to top