Enhancing immediacy of identification with multi-stage application identification

Abstract

The identification of network application is important for network management such as traffic controls and anomaly traffic detection. To apply application-based traffic control promptly, the technique to progressive application identification is important. We previously proposed a method of timeliness identification of application, which can achieve to use first several packets of flow to identify applications with high accuracy whatever the traffic is encrypted or unencrypted. However, our previous method still has a challenge in terms of timeliness because it uses a single classifier with same traffic features to identify all applications, though some traffic features can be used earlier. In this paper, we propose a method of multistage application identification, which classifies progressively applications into groups with different granularity of groups. We first demonstrate that the accuracy of existing application identification is getting worse significantly, by increasing the number of application to identify. Second, propose a method of multistage identification method, and then explain group classification algorithm to classify applications into groups. Our experiment shows that our proposed method can identify applications earlier than a method of identification using a single classifier.