A VoIP Traffic Identification Scheme Based on Host and Flow Behavior Analysis

With the rapid growth of the encrypted network traffic, the identification to it becomes a hot topic in information security. Since the existing methods have difficulties in identifying the application which the encrypted traffic belongs to, a new encrypted traffic identification scheme is proposed in this paper. The proposed scheme has two levels. In the first level, the entropy and estimation of Monte Carlo π value as features are used to identify the encrypted traffic by C4.5 decision tree. In the second level, the application types are distinguished from the encrypted traffic selected above. First, the variational automatic encoder is used to extract the layer features, which is combined with the frequently-used stream features. Meanwhile, the mutual information is used to reduce the dimensionality of the combination features. Finally, the random forest classifier is used to obtain the optimal result. Compared with the existing methods, the experimental results show that the proposed scheme not only has faster convergence speed but also achieves better performance in the recognition accuracy, recall rate, and F1-Measure, which is higher than 97%.

Download Full-text

Graph analysis of network flow connectivity behaviors

TURKISH JOURNAL OF ELECTRICAL ENGINEERING & COMPUTER SCIENCES ◽

10.3906/elk-1808-148 ◽

2019 ◽

pp. 861-877

Author(s):

HANGYU HU ◽

XUEMENG ZHAI ◽

MINGDA WANG ◽

GUANGMIN HU

Keyword(s):

Behavior Analysis ◽

Network Flow ◽

Graph Mining ◽

Network Flows ◽

Flow Behavior ◽

Edge Weight ◽

Event Identification ◽

Node Ranking ◽

Graph Simplification ◽

Network Event

Graph-based approaches have been widely employed to facilitate in analyzing network flow connectivity behaviors, which aim to understand the impacts and patterns of network events. However, existing approaches suffer from lack of connectivity-behavior information and loss of network event identification. In this paper, we propose network flow connectivity graphs (NFCGs) to capture network flow behavior for modeling social behaviors from network entities. Given a set of flows, edges of a NFCG are generated by connecting pairwise hosts who communicate with each other. To preserve more information about network flows, we also embed node-ranking values and edge-weight vectors into the original NFCG. After that, a network flow connectivity behavior analysis framework is present based on NFCGs. The proposed framework consists of three modules: a graph simplification module based on diversified filtering rules, a graph feature analysis module based on quantitative or semiquantitative analysis, and a graph structure analysis module based on several graph mining methods. Furthermore, we evaluate our NFCG-based framework by using real network traffic data. The results show that NFCGs and the proposed framework can not only achieve good performance on network behavior analysis but also exhibit excellent scalability for further algorithmic implementations.

Download Full-text