A framework for detecting Internet applications

Abstract

There are several network management and measurement tasks, including for example traffic engineering, service differentiation, performance or failure monitoring or security, that can greatly benefit with the ability to perform an accurate mapping of network traffic to IP applications. In the last years traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. Thus, new solutions are needed for this problem and this paper presents a new approach, based on neural networks, that is able to solve the problem of application detection and at the same time can predict the traffic level associated with each application based on the overall aggregated traffic, while overcoming the limitations of the previous approaches. Results obtained show that the proposed framework constitutes a valuable tool to detect Internet applications and predict their traffic levels since it can achieve good performance results while, at the same time, avoid the most important disadvantages presented by the other detection methods. © 2008 Springer Berlin Heidelberg.