Presentation is loading. Please wait.

Presentation is loading. Please wait.

KISS: Stochastic Packet Inspection for UDP Traffic Classification Dario Bonfiglio, Alessandro Finamore, Marco Mellia, Michela Meo, Dario Rossi 1.

Similar presentations


Presentation on theme: "KISS: Stochastic Packet Inspection for UDP Traffic Classification Dario Bonfiglio, Alessandro Finamore, Marco Mellia, Michela Meo, Dario Rossi 1."— Presentation transcript:

1 KISS: Stochastic Packet Inspection for UDP Traffic Classification Dario Bonfiglio, Alessandro Finamore, Marco Mellia, Michela Meo, Dario Rossi 1

2 Traffic classification Look at the packets… Tell me what protocol and/or application generated them

3 Typical approach: Deep Packet Inspection (DPI) Port: Port: 4662/4672 Port: Payload: “bittorrent” Payload: E4/E5 Payload: RTP protocol PPLiveBittorrent GtalkeMule

4 Typical approach: Deep Packet Inspection (DPI) Port: Port: 4662/4672 Port: Payload: “bittorrent” Payload: E4/E5 Payload: RTP protocol PPLiveBittorrent GtalkeMule It fails more and more: P2P Encryption Proprietary solutions Many different flavours

5 Possible Solution: Behavioral Classifier Phase 1 Feature Phase 3 Verify 1. Statistical characterization of traffic (given source) 2. Look for the behaviour of unknown traffic and assign the class that better fits it 3. Check for possible classification mistakes Phase 2 Decision Traffic (Known) (Training) (Operation)

6 Phase 1 Feature Phase 3 Verify Phase 2 Decision Traffic (Known) Phase 1 : Statistical characterization Statistical characterization of bits in a flow Test  2 Do NOT look at the SEMANTIC and TIMING … but rather look at the protocol FORMAT

7 Chunking and  2 First N payload bytes C chunks each of b bits  2 1  2 C [], …, Vector of Statistics The provides an implicit measure of entropy or randomness of the payload  2 Observed distribution Expected distribution (uniform)

8 Chi square statistics

9 Time Deterministic Counter Random Deterministic 24 Chunks == 12 payload bytes, 4bit x Chunk

10 DNS eMule RTP  2 Protocol format as seen from the

11 Statistical characterization of bits in a flow Decision process Test Minimum distance / maximum likelihood  2 Phase 1 Feature Phase 3 Verify Phase 2 Decision Traffic (Known) Phase 2 : Decision process

12 C-dimension space  2 1  2 C [], …, Hyperspace Classification Regions Euclidean Distance Support Vector Machine  2 i  2 j Class My Point

13 Example

14 Performance evaluation How accurate is all this? Phase 3 : Performance Phase 1 Feature Phase 3 Verify Phase 2 Decision Traffic (Known) Statistical characterization of bits in a flow Decision process Test Minimum distance / maximum likelihood  2

15 Real traffic traces Internet Fastweb Known + Other Training Known Traffic False Negatives Unknown traffic False Positives Trace RTP eMule DNS Oracle (Manual DPI) other Complement of known traffic 1 day long trace 20 GByte of UDP traffic > 90% of tot. volume

16 Definition of false positive/negative Classifing “known” true positives false negatives true negatives false positives Classifing “other” KISS Traffic Oracle (DPI) eMule RTP DNS Other

17 Case ACase B Rtp Edk Dns Case ACase B Case ACase B other Euclidean Distance SVM Case ACase B Results (local) Known traffic (False Neg.) [%] Other (False Pos.) [%]

18 Real traffic trace RTP errors are oracle mistakes (do not identify RTP v1) DNS errors are due to impure training set (for the oracle all port 53 is DNS traffic) EDK errors are (maybe) Xbox Live (proper training for “other”) FN are always below 3%!!!

19 P2P-TV applications P2P-TV applications are becoming popular They heavily rely on UDP at the transport protocol They are based on proprietary protocols They are evolving over time very quickly Tot. Vectors% FN Joost PPLive SopCast Tvants Tot. Vectors% FP Other1.2M0.3

20 Pros and Cons KISS is good because… Blind approach Completely automated Works with many protocols Works even with small training Statistics can start at any point Robust w.r.t. packet drops Bypasses some DPI problems but… Learn (other) properly Needs volumes of traffic May require memory (for now) Only UDP (for now) Only offline (for now)

21 Papers D. Bonfiglio, M. Mellia, M. Meo, D. Rossi, P. Tofanelli “Revealing skype traffic: when randomness plays with you”, ACM SIGCOMM Computer Communication Review "4", Vol. 37, pp , ISSN: , October 2007 D. Rossi, M. Mellia, M. Meo, “Following Skype Signaling Footsteps”, IT- NEWS - QoS-IP The Fourth International Workshop on QoS in Multiservice IP Networks, Venice, Febbruary D. Rossi, M. Mellia, M. Meo, “A Detailed Measurement of Skype Network Traffic”, 7th International Workshop on Peer-to-Peer Systems (IPTPS '08), Tampa Bay, Florida, 25-26/2/2008 D. Bonfiglio, M. Mellia, M. Meo, N. Ritacca, D. Rossi, “Tracking Down Skype Traffic”, IEEE Infocom, Phoenix, AZ, 15,17 April 2008 D.Bonfiglio, A. Finamore, M. Mellia, M. Meo, D. Rossi, “KISS: Stochastic Packet Inspection for UDP Traffic Classification”, submitted to InfoCom09


Download ppt "KISS: Stochastic Packet Inspection for UDP Traffic Classification Dario Bonfiglio, Alessandro Finamore, Marco Mellia, Michela Meo, Dario Rossi 1."

Similar presentations


Ads by Google