Sviluppo di una tecnica di riconoscimento statistico di applicazioni su rete IP

Network traffic recognition and identification based upon applications that generated it, is becoming fundamental for many management processes like:
- granting an adequate quality of service;
- managing billing policies;
- analyze sudden changes in the traffic dynamics and combat possible attacks.
In the latest years there was a development of softwares that un recognizable with the classic techniques such as port or payload inspection. New approaches were needed and the most successful were the statistical ones.
For the first thing we devided the classification methods of literature in three categories
: Session-based, Content-based e Constraint-based.
We analyzed the first two, pointing out their limitations and then we addressed to the third category.
The statistical methods were so devided on tha basis of the accuracy of the identification (per classes of applications or applications), in supervised or not supervised and in probabilistic or deterministic.
The studied method is fine-grained, supervised and probabilistic; it is moreover based upon charachteristica of the packets that can be got looking uniquely to IP level such as the dimension of the packets in bytes, the temporal distance fromthe first packet of a session and the order number of a packet.
The ID strategy is based upon the maximum likelihood criterium; in particular we considered tha application that generated the traffic as the one with tha maximumn a-priori probability. The ID method was developed according to three ways:pachet independent, dependent or forming a Markov chain.
We also made a comparison with a deterministic method based upon the minimum square distance.
The practical work consisted into the capture of traces with WireShark, writing Java code for the algorithm implementation and simulation to validate the algorithm. the studied protocols were HTTP, HTTPS and SIP. the varying parameters in the simulation were:
- M, the significant number of packets in a session;
- a session duration;
- the number of quantization slot in the Dimension x Time plane.
To complete the work we tried to integrate the ID method ina realtime capture to allow a dynamic identification. to this aim the various pdf were precomputed, while for traffic capture we exploited the Jpcap library.