Application feature extraction by using both dynamic binary tracking and statistical learning

Abstract

While application feature extraction is popular in recent researches of traffic classification, only a few studies have extracted application features by synthetically analyzing packet payloads, port allocation and flow-level statistics. In this paper, we apply the techniques of both dynamic binary tracking and statistical learning in application feature extraction. Specifically, we first accurately capture the payload contents by reversely debugging an application in an automatic way, and then recursively cluster those contents to generate protocol signatures. Afterwards, we perform port statistical analysis to generate a port association rule. To identify the encrypted applications, we present a feature selection algorithm for selecting the optimal features from the time series statistics of the first ten packet sizes of each TCP flow. Compared with three typical feature selection algorithms, we validate that our proposed feature selection algorithm is more effectiveness. Additionally, we propose a scheme to synthetically apply protocol signatures, port association and flow statistics in traffic classification. By evaluating our method on the identification of Thunder flows, we show that the combination of protocol signatures, port association and flow statistics is promising in traffic classification.