Presentation is loading. Please wait.

Presentation is loading. Please wait.

Heuristics to Classify Internet Backbone Traffic based on Connection Patterns Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering.

Published byArron McDonald Modified over 8 years ago

Similar presentations

Presentation on theme: "Heuristics to Classify Internet Backbone Traffic based on Connection Patterns Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering."— Presentation transcript:

1 Heuristics to Classify Internet Backbone Traffic based on Connection Patterns Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University of Technology Göteborg, Sweden

2 2008-01-23ICOIN 2008 Introduction: Measurement location Internet Regiona l ISPs Göteborg Stockholm Other smaller Univ. and Institutes Göteborg’s Univ. Student- Net 2x 10 Gbit/s (OC-192) capturing headers only IP addresses anonymized tightly synchronized bidirectional per-flow analysis Chalmers Univ.

3 2008-01-23ICOIN 2008 Introduction: Motivation Problem: –Operators don’t know the type of their traffic –How to: Improve network design and provisioning? Support QoS support or security monitoring? Enhance accounting possibilities? Reveal trends and changes in network applications?

4 2008-01-23ICOIN 2008 Introduction: Classification Solution: Traffic classification –Four basic approaches: 1.Port numbers + easy to implement - unreliable (P2P, malicious traffic) 2.Packet payloads + accurate - requires updated payload signatures - privacy and legal issues - high processing requirements - does not work on encrypted traffic (P2P)

5 2008-01-23ICOIN 2008 Introduction: Classification (2) Solution: Traffic classification (contd.) 3.Statistical fingerprinting + no detailed packet information needed - depending on quality of training data - promising, but still immature 4.Connection patterns + no payload required + no training data required - not perfect accuracy

6 2008-01-23ICOIN 2008 Methodology: Traffic Classification Two articles classify P2P flows according to connection patterns: –Karagiannis et al., 2004 –Perenyi et al., 2006 Updated classification heuristics: –Refined the heuristics in prior articles –Added new, necessary heuristics

7 2008-01-23ICOIN 2008 Methodology: Proposed Heuristics Rules based on connection patterns and port numbers –5 rules for P2P traffic (H1-H5) –10 rules to classify other traffic types (F1-F10) remove ‘false positives’ from P2P –Rules are applied: On flows in 10 minute intervals Independently on all flows and prioritized when fetched from the database

8 2008-01-23ICOIN 2008 Methodology: Proposed Heuristics (2) –Heuristics for potential P2P traffic (H1-H5) All traffic to and from potential P2P hosts is marked as P2P traffic H1: TCP and UDP traffic between IP pair H2: Well known P2P ports H3: Re-usage of source Port within short time H4: Non-parallel connections to endpoint (IP/Port) H5: unclassified, long flows –unclassified by H1-H4 and F1-F9 –more than 1MB in one direction or –duration of more than 10 minutes

9 2008-01-23ICOIN 2008 Methodology: Proposed Heuristics (3) –Heuristics for other traffic (F1-F10) F1 and F2: Web servers: –parallel connections to web Ports –All traffic to and from Web server is Web-traffic F3: common services (DNS, BGP) –Equal source and destination port and port<501 F4: Mail servers: –Hosts receiving traffic on mail ports (smtp, imap, pop) while sending traffic via smtp –All traffic to and from Mail servers is Mail-traffic

10 2008-01-23ICOIN 2008 Methodology: Proposed Heuristics (4) –Heuristics for other traffic (F1-F10) F5 and F6: Messenger and Gaming –Hosts, connected to by a number of different IPs on well- known messenger, chat or gaming ports within a period of 10 days –All traffic to and from these hosts is messenger or gaming F7: FTP –Active FTP with initiating port number of 20 F8: non P2P ports: –Some well-known, privileged port number, typically not used by P2P like dns, telnet, ssh, ftp, mail, rtp, bgp …

11 2008-01-23ICOIN 2008 Methodology: Proposed Heuristics (5) –Heuristics for other traffic (F1-F10) F9: malicious and attack traffic –Scans (scan from one source through port ranges) –Sweeps (scans from one source through IP ranges) –DoS attacks (“hammering attacks” from one source to few hosts in high frequency) F10: unclassified, known non-P2P Port –unclassified by H1-H4 and F1-F9 (no connection pattern) –Well known ports including Web, messenger and gaming

12 2008-01-23ICOIN 2008 Verification of proposed rule-set # connections in 10 6 Amount of data in TB Comparison of classification methods for P2P traffic

13 2008-01-23ICOIN 2008 Results Application Breakdown April 2006

14 2008-01-23ICOIN 2008 Results (2) Detailed results will be published at PAM 2008 W. John and S. Tafvelin and Tomas Olovsson, Trends and Differences in Connection Behavior within Classes of Internet Backbone Traffic, to be presented at the Passive and Active Measurement Conference, Cleveland, Ohio, USA, April 2008. (Proceedings to be published in Springer LNSC) http://pam2008.cs.wpi.edu/ http://pam2008.cs.wpi.edu/ Documentation about measurements (raw data) DatCat – Internet Measurement Data Catalog by CAIDA http://www.datcat.org (search for SUNET) http://www.datcat.org

15 2008-01-23ICOIN 2008 Conclusions Previous classification methods on packet header traces don’t work well on backbone data Proposal of refined and updates heuristics –Combining previous approaches –Extension and adjustment of heuristics –Including a rule for attack traffic Simple and fast method to decompose traffic –no payload required (encryption, header data, etc.) Effectively used even on short traces (10 min) 0.2% of the data left unclassified

16 Thank you very much for you attention! Questions?

Download ppt "Heuristics to Classify Internet Backbone Traffic based on Connection Patterns Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering."

Similar presentations

Firewall Simulation Teaching Information Security Using: Visualization Tools, Case Studies, and Hands-on Exercises May 23, 2012.

Firewall Simulation Teaching Information Security Using: Visualization Tools, Case Studies, and Hands-on Exercises May 23, 2012.
Predicting Tor Path Compromise by Exit Port IEEE WIDA 2009December 16, 2009 Kevin Bauer, Dirk Grunwald, and Douglas Sicker University of Colorado Client.

Predicting Tor Path Compromise by Exit Port IEEE WIDA 2009December 16, 2009 Kevin Bauer, Dirk Grunwald, and Douglas Sicker University of Colorado Client.
Marios Iliofotou (UC Riverside) Brian Gallagher (LLNL)Tina Eliassi-Rad (Rutgers University) Guowu Xi (UC Riverside)Michalis Faloutsos (UC Riverside) ACM.

Marios Iliofotou (UC Riverside) Brian Gallagher (LLNL)Tina Eliassi-Rad (Rutgers University) Guowu Xi (UC Riverside)Michalis Faloutsos (UC Riverside) ACM.
Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.
 Firewalls and Application Level Gateways (ALGs)  Usually configured to protect from at least two types of attack ▪ Control sites which local users.

 Firewalls and Application Level Gateways (ALGs)  Usually configured to protect from at least two types of attack ▪ Control sites which local users.
Application Layer 2-1 Chapter 2 Application Layer Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Application Layer – Lecture.

Application Layer 2-1 Chapter 2 Application Layer Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Application Layer – Lecture.
NETWORK SECURITY INTRUSION DETECTION SYSTEMS (IDS) KANDIAH.M Clarkson University, Potsdam, New York.

NETWORK SECURITY INTRUSION DETECTION SYSTEMS (IDS) KANDIAH.M Clarkson University, Potsdam, New York.
BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.

BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.
Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.

Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.
5/1/2006Sireesha/IDS1 Intrusion Detection Systems (A preliminary study) Sireesha Dasaraju CS526 - Advanced Internet Systems UCCS.

5/1/2006Sireesha/IDS1 Intrusion Detection Systems (A preliminary study) Sireesha Dasaraju CS526 - Advanced Internet Systems UCCS.
CLIENT / SERVER ARCHITECTURE AYRİS UYGUR & NİLÜFER ÇANGA.

CLIENT / SERVER ARCHITECTURE AYRİS UYGUR & NİLÜFER ÇANGA.
© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 6: Cisco IOS Threat Defense Features.

© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 6: Cisco IOS Threat Defense Features.
Treatment-Based Traffic Signatures Mark Claypool Robert Kinicki Craig Wills Computer Science Department Worcester Polytechnic Institute

Treatment-Based Traffic Signatures Mark Claypool Robert Kinicki Craig Wills Computer Science Department Worcester Polytechnic Institute
Slide title In CAPITALS 50 pt Slide subtitle 32 pt On the Validation of Traffic Classification Algorithms Géza Szabó, Dániel Orincsay, Szabolcs Malomsoky,

Slide title In CAPITALS 50 pt Slide subtitle 32 pt On the Validation of Traffic Classification Algorithms Géza Szabó, Dániel Orincsay, Szabolcs Malomsoky,
Unconstrained Endpoint Profiling (Googling the Internet)‏ Ionut Trestian Supranamaya Ranjan Aleksandar Kuzmanovic Antonio Nucci Northwestern University.

Unconstrained Endpoint Profiling (Googling the Internet)‏ Ionut Trestian Supranamaya Ranjan Aleksandar Kuzmanovic Antonio Nucci Northwestern University.
Assessing the Nature of Internet traffic: Methods and Pitfalls Wolfgang John Chalmers University of Technology, Sweden together with Min Zhang Beijing.

Assessing the Nature of Internet traffic: Methods and Pitfalls Wolfgang John Chalmers University of Technology, Sweden together with Min Zhang Beijing.
Licentiate Seminar: On Measurement and Analysis of Internet Backbone Traffic Wolfgang John Department of Computer Science and Engineering Chalmers University.

Licentiate Seminar: On Measurement and Analysis of Internet Backbone Traffic Wolfgang John Department of Computer Science and Engineering Chalmers University.
Fundamentals of Computer Networks ECE 478/578 Lecture #2 Instructor: Loukas Lazos Dept of Electrical and Computer Engineering University of Arizona.

Fundamentals of Computer Networks ECE 478/578 Lecture #2 Instructor: Loukas Lazos Dept of Electrical and Computer Engineering University of Arizona.
FIREWALL TECHNOLOGIES Tahani al jehani. Firewall benefits  A firewall functions as a choke point – all traffic in and out must pass through this single.

FIREWALL TECHNOLOGIES Tahani al jehani. Firewall benefits  A firewall functions as a choke point – all traffic in and out must pass through this single.
Lucent Technologies – Proprietary Use pursuant to company instruction Learning Sequential Models for Detecting Anomalous Protocol Usage (work in progress)

Lucent Technologies – Proprietary Use pursuant to company instruction Learning Sequential Models for Detecting Anomalous Protocol Usage (work in progress)

Similar presentations

Ads by Google