With many network protocols using obfuscation techniques to hide their identity, robust methods of traffic classification are required. In traditional deep-packet-inspection (DPI) methods, application specific signatures are generated with byte-level data from payload. Increasingly new data formats are being used to encode the application protocols with bit-level information which render the byte-level signatures ineffective. In this paper, we describe BitCoding a bit-level DPI-based signature generation technique. BitCoding uses only a small number of initial bits from a flow and identify invariant bits as signature. Subsequently, these bit signatures are encoded and transformed into a newly defined state transition machine transition constrained counting automata. While short signatures are efficient for processing, this will increase the chances of collision and cross signature matching with increase in number of signatures (applications). We describe a method for signature similarity detection using a variant of Hamming distance and propose to increase the length of signatures for a subset of protocols to avoid overlaps. We perform extensive experiments with three different data sets consisting of 537 380 flows with a packet count of 3 445 969 and show that, BitCoding has very good detection performance across different types of protocols (text, binary, and proprietary) making it protocol-type agnostic. Further, to understand the portability of signatures generated we perform cross evaluation, i.e., signatures generated from one site are used for testing with data from other sites to conclude that it will lead to a small compromise in detection performance.

Neminath Hubballi

Mayank Swarnkar

IEEE/ACM Transactions on Networking

IEEE/ACM TRANSACTIONS ON NETWORKING 的高层次目标是发表来自通信/计算机网络领域的理论或实验探索的高质量原创研究成果，涵盖各种物理层技术上的各种信息传输网络，有线（各种引导媒体：例如，铜、光学）和无线（例如，射频、声学（例如，水下）、红外线），或这些的混合。该杂志欢迎报告新经验和实际系统实验的应用贡献。

The IEEE/ACM Transactions on Networking aims to publish high-quality original research results from the field of communication and computer networking. These studies can be theoretical or experimental, covering various physical layer technologies for information transmission networks, including wired networks (such as copper and optical media) and wireless networks (such as radio frequency, acoustic (e.g., underwater), and infrared), as well as hybrid applications of these technologies. The journal welcomes reports of new experiences and practical system experimental contributions.

IEEE/ACM Transactions on Networking 的目标是发表通信和计算机网络领域的高质量原创研究成果。这些研究可以是理论性的，也可以是实验性的，涵盖各种物理层技术的信息传输网络，包括有线网络（如铜缆和光纤）和无线网络（如射频、声学（例如水下声学）和红外线），以及这些技术的混合应用。该期刊欢迎报告新的经验和实际系统实验的应用贡献。

$BitCoding$ : Network Traffic Classification Through Encoded Bit Level Signatures

BitCoding is described, a bit-level DPI-based signature generation technique that has very good detection performance across different types of protocols (text, binary, and proprietary) making it protocol-type agnostic.

Category	Quartile
计算机科学	3
计算机科学, 计算机理论方法	2
计算机科学, 计算机硬件	3
计算机科学, 工程电子与电气	3
计算机科学, 电信学	3

$BitCoding$ : Network Traffic Classification Through Encoded Bit Level Signatures

ivySCI AI Smartly Parses PDF, Answers Researchers' Questions, and Helps You Understand Papers in Seconds

Journal Info