Name
Abstract | ||
|---|---|---|
The use of application-layer tunnels has become more popular nowadays. By using encrypted tunnels for prohibited application such as peer-to-peer file sharing it is easy to gain access to restricted networks. Application-layer tunnels provide a possibility to bypass network defenses which is even more useful for malicious users trying to avoid detection. The accurate identification of application flows in encrypted tunnels is important for the network security and management purposes. Traditional network traffic classification methods based on port numbers or pattern-matching mechanisms are practically useless in identifying application flows inside an encrypted tunnel, therefore another approach is needed. In this paper, we propose a two-phased method for classifying SSH tunneled application flows in real time. The classification is based on the statistical features of the network flows. The first classification phase identifies the SSH connection while the second classification phase detects the tunneled application. A simple K-Means clustering algorithm is utilized in classification. We evaluated our method using manually generated packet traces. The results were promising; over 94% of all flow samples were classified correctly, while untrained application flow samples were detected as unknown at high precision. |
Year | DOI | Venue |
|---|---|---|
2011 | 10.1109/IWCMC.2011.5982683 | Wireless Communications and Mobile Computing Conference |
Keywords | Field | DocType |
computer network management,computer network security,cryptography,pattern matching,peer-to-peer computing,telecommunication traffic,K-means clustering algorithm,SSH connection,SSH encrypted tunneled application flow identification,application flow sample,application layer tunnel,bypass network management,classification phase identification,network flow,network traffic classification method,packet tracing,pattern matching mechanism,peer-to-peer file sharing,phase detection,restricted network security,statistical feature,two-phased method,K-means,SSH analysis,Traffic monitoring | Traffic classification,Flow network,k-means clustering,Computer science,Network packet,Network security,Computer network,Encryption,Secure Shell,Cluster analysis | Conference |
ISSN | ISBN | Citations |
2376-6492 | 978-1-4244-9539-9 | 1 |
PageRank | References | Authors |
0.38 | 7 | 2 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Matti Hirvonen | 1 | 5 | 0.85 |
| Mirko Sailio | 2 | 1 | 0.71 |