A Hybrid Method based on Statistical Features and Packet Content Analysis to Identify Major Network Tunneling Protocols
Publish place: Journal of Computing and Security، Vol: 3، Issue: 2
Publish Year: 1395
نوع سند: مقاله ژورنالی
زبان: English
View: 115
This Paper With 16 Page And PDF Format Ready To Download
- Certificate
- من نویسنده این مقاله هستم
استخراج به نرم افزارهای پژوهشی:
شناسه ملی سند علمی:
JR_JCSE-3-2_002
تاریخ نمایه سازی: 12 دی 1400
Abstract:
Network traffic identification is an essential component for effective network analysis and management. Signature-based and machine learning techniques are the two most important methods in network traffic analysis. Due to the strengths and weaknesses of these two approaches, their combination can strengthen them and remove the weaknesses of each in detection process. In this article, a hybrid method is introduced, to identify major network tunneling protocols. This method can detect the well-known tunneling protocols by combining signature-based methods and statistical analysis techniques through a clustering algorithm. In this proposed method, the clustering process is refined by the feedback of signature-base method. Since, in semi-supervised clustering, it is important to gain most informative data to improve the clustering performance, in the proposed clustering method, a new active learning approach is introduced for selecting informative constraints. In this hybrid method, four tunneling protocols (L۲TP, PPTP, IPsec and OpenVPN) are applied. The obtained results indicate that this proposed hybrid method significantly increases accuracy and cluster purity, and these protocols are identified with high accuracy and low processing cost.
Keywords:
Authors
Keihan Kazemi
PhD Candidate
Ali Fanian
Professor Assistance in isfahan university of thenology