Ing. Jan Pluskal

PLUSKAL Jan, LICHTNER Ondrej and RY©AVÝ Ondřej. Traffic Classification and Application Identification in Network Forensics. In: Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics. New Delhi: Springer International Publishing, 2018, pp. 161-181. ISBN 978-3-319-99277-8.
Publication language:english
Original title:Traffic Classification and Application Identification in Network Forensics
Title (cs):Klasifikace sí»ového provozu i komunikujících aplikací v sí»ové forenzní analýze
Pages:161-181
Proceedings:Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics
Conference:Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics
Place:New Delhi, IN
Year:2018
ISBN:978-3-319-99277-8
DOI:10.1007/978-3-319-99277-8
Publisher:Springer International Publishing
Keywords
network forensics, network traffic classification, statistical protocol identification, application identification, application protocol identification, machine learning, random forests, Bayesian classifier
Annotation
Network traffic classification is an absolute necessity for network monitoring, security analysis, and digital forensics. Without accurate traffic classification, computation demands on analysis of all IP flows are enormous. Classification can also reduce the number of flows that need to be analyzed, prioritize, and order them for an investigator to analyze the most forensically significant first. This paper presents an automatic feature elimination method based on a feature correlation matrix. Furthermore, we compare two algorithms adapted from literature, that offer high accuracy and acceptable performance, and our algorithm -- Enhanced Statistical Protocol Identification (ESPI). Each of these algorithms is used with a subset of features that best suits it. We evaluate these algorithms on their ability to identify application layer protocols and additionally applications themselves. Experiments show that the Random Forest based classifier yields the most promising results, whereas our algorithm provides an interesting tradeoff between higher performance and slightly lower accuracy.
BibTeX:
@INPROCEEDINGS{
   author = {Jan Pluskal and Ondrej Lichtner and Ond{\v{r}}ej
	Ry{\v{s}}av{\'{y}}},
   title = {Traffic Classification and Application
	Identification in Network Forensics},
   pages = {161--181},
   booktitle = {Fourteenth Annual IFIP WG 11.9 International Conference on
	Digital Forensics},
   year = 2018,
   location = {New Delhi, IN},
   publisher = {Springer International Publishing},
   ISBN = {978-3-319-99277-8},
   doi = {10.1007/978-3-319-99277-8},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php?id=11511}
}

Your IPv4 address: 3.81.28.94
Switch to https