1. Treatment-Based Traffic Signatures Mark Claypool Robert Kinicki Craig Wills Computer Science Department Worcester Polytechnic Institute http://www.cs.wpi.edu/~claypool/papers/cube/

2. October 2007 IMRG WACI, Cambridge, MA, USA2 Diversity of Internet Applications in the Home Web Browsing Network Games Video Streaming Voice over IP Remote Login Instant Messaging Sensors Email Delay Insensitive Delay Sensitive P2P File Sharing Loss Sensitive Loss Insensitive Jitter Insensitive Jitter Sensitive

3. October 2007 IMRG WACI, Cambridge, MA, USA3 Proliferation of Network Devices in the Home Wireless Access Point Hand Held Game Devices Personal Computers Printers and Faxes Mobile Phones Streaming Video Servers Game Consoles IP Phone (to Internet) Opportunity…  “Smart” AP Automatically improves performance Interoperable, easy-to- use But first…  Need to classify applications Then can apply treatment to improve QoS

4. October 2007 IMRG WACI, Cambridge, MA, USA4 Outline Introduction(done) Goals +(next) Classification Preliminary Results Ongoing Work

5. October 2007 IMRG WACI, Cambridge, MA, USA5 Goals Classification for purpose of QoS treatments (versus DoS prevention or billing or measurement or …) –Want match between signatures and potential treatments Not classifying applications  instead concentrate on nature of traffic for specific applications and devices –Different applications with same QoS requirements should get equal network treatments e.g. VoIP and network game –Not all instances of a particular application yield the same signature, nor is that needed e.g. Web for browsing, Web for download

6. October 2007 IMRG WACI, Cambridge, MA, USA6 Related Approaches Port classification alone does not work –Applications can share ports e.g. Non Web apps use port 80 around firewalls e.g. scp and ssh both over port 22 –Users run applications on non-standard ports e.g. Web server on different port since 80 restricted –New applications not officially defined for ports Payload examination alone does not work –Increased encryption at application layer –Can be computationally expensive –New applications cannot be identified this way Machine learning alone does not work –Takes too long in real-time, so must be done offline first –Needs external validation, so does not work with new apps

7. October 2007 IMRG WACI, Cambridge, MA, USA7 Domain Provide classification in wireless Access Point (AP), the same point that provides QoS treatment Home environment –Both directions of a flow travel through AP –Users are not trying to avoid classification –Can be customized and flexible per-flow treatments Home APs carry few flows compared to core router Needs to be real-time –Quick, so as to apply treatment to improve QoS

8. October 2007 IMRG WACI, Cambridge, MA, USA8 Outline Introduction(done) Goals +(done) Classification(next) Preliminary Results Ongoing Work

9. October 2007 IMRG WACI, Cambridge, MA, USA9 Treatment-Based Classification Nature of Reverse Traffic Response-basedNon-response-based Packet Size Tendency Full Non-full Transmission Spacing As available Paced Drop Packets Space Packets ftp p2p web telnet ssh games streaming voip sensors Push Packets Delay Packets

10. October 2007 IMRG WACI, Cambridge, MA, USA10 Outline Introduction(done) Goals +(done) Classification(done) Preliminary Results(next) Ongoing Work

11. October 2007 IMRG WACI, Cambridge, MA, USA11 Preliminary Results Captured 20-second traces from some representative applications Nature of reverse traffic –Response based or Non-response based Packet size tendency –Full or Non-full Transmission spacing –Paced or As-available

12. October 2007 IMRG WACI, Cambridge, MA, USA12 Nature of Reverse Traffic TCP automatically makes it response-based UDP is trickier - is a downstream packet sent in response to one upstream (or vice versa)? First, try simple up/down count: ApplicationDownUp Streaming video1172521 Network game3931231 VoIP934935 More work needed …

13. October 2007 IMRG WACI, Cambridge, MA, USA13 Packet Size Tendency http – browsing cnn wsm – video ssh – reading email ftp – large file

14. October 2007 IMRG WACI, Cambridge, MA, USA14 Transmission Spacing (1 of 2) wsm – videossh – reading email ftp – large file http – browsing cnn

15. October 2007 IMRG WACI, Cambridge, MA, USA15 Transmission Spacing (2 of 2) http – browsing http – download http – streaming

16. October 2007 IMRG WACI, Cambridge, MA, USA16 Data for Some Other Applications voip – packet sizegame – packet size game – transmission spacingvoip – transmission spacing

17. October 2007 IMRG WACI, Cambridge, MA, USA17 Ongoing Work Differentiation of “paced” and “as available” Identification of “responsed-based” UDP –e.g. DNS or VoIP over DCCP Definition of “full” packets –e.g. Streaming video packets of 1400 bytes “Memory” of classification –e.g. in Second Life, interact on estate then teleport –Statistics: continuous, weighted, or windowed –Across flows for the same device e.g. Game console (Xbox) versus PC Need for more traces of applications in the home

18. Treatment-Based Traffic Signatures Mark Claypool Robert Kinicki Craig Wills Computer Science Department Worcester Polytechnic Institute http://www.cs.wpi.edu/~claypool/papers/cube/