# AppIdent
Enhance Statistical Protocol Identification, Bayesian network and Random forests classification of application protocols.

# Basic Information
* [Configuration of tests](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/testedCombinations.pdf)
* [All features](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/allFeatures.pdf)
* [Capture Statistics](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/captureStats.pdf)
* [Features Selection](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/featureSelection.pdf)

# Training to Verification Ratio
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/pat2v.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/appTagsPAt2v.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/appTagsPBt2v.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/testedCombinations.pdf)

# Result Comparison
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/comparisonPA.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/comparisonPAAppTags.pdf)

# Bayesian Classifier
## Training to Verification Ratio 0.1
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA01.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA01AppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB01.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB01AppTags.pdf)

## Training to Verification Ratio 0.2
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA02.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA02AppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB02.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB02AppTags.pdf)

## Training to Verification Ratio 0.5
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA05.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPA05AppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB05.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/BayesPB05AppTags.pdf)

# Enhance Statistical Protocol Identification - ESPI
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/espiPA.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/espiPAAppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/espiPB.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/espiPBAppTags.pdf)

# Random Forests
## Training to Verification Ratio 0.1
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPA01.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPA01AppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPB01.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPB01AppTags.pdf)

## Training to Verification Ratio 0.2
* [Port agregated](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPA02.pdf)
* [Port agregated AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPA02AppTags.pdf)
* [Port base](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPB02.pdf)
* [Port base AppTags](https://github.com/pluskal/AppIdent/blob/gh-pages/Pages/randomForestsPB02AppTags.pdf)

# Binary data source
* [Port base source](https://mega.nz/#!0BBGlSDI!CmEPJrchymnPRK3bMrKNojdnhgrZndVWlM-vrWjvLsg)
* [Port aggregate source](https://mega.nz/#!FchyCR4L!dM0pqmbX14tGqGUe8gTGiP0iKwGVXZaLbvsOdL201m4)

# Annotated PCAP files
* [All data sets binary and PCAP files](http://nes.fit.vutbr.cz/AppIdent/)
* Data sets are in Microsoft Network Monitor 3.4 (mnm, *.cap) format where process info table is stored

# Netfox Detective
* [Data processing framework](https://github.com/nesfit/NetfoxDetective)
