Skype Traffic Identification Based on Trends-Aware Protocol Fingerprints

Abstract:

The P2P technology consumes the largest proportion of network traffic and is usually encrypted, which is lack of supervision. Accurate and rapid identification of encrypted P2P traffic, represented by the famous Skype, is of great significance to improve the network quality of service and enhance security control. In this paper, a trends-aware protocol fingerprints model is proposed based on the statistical signatures of signaling interactions and content transfer phase of Skype. The proposed method can sense traffic trends by trends-aware weighting functions and identify Skype traffic with anomaly scores in real-time. Experimental results show that the precision and real-time performances of the proposed algorithm is better than several state-of-art encrypted traffic identification methods, such as the protocol fingerprints and C4.5 algorithm.

• Periodical: Applied Mechanics and Materials (Volumes 543-547)
• Pages: 2249-2254
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.543-547.2249
• Online since: March 2014
• Authors: Wei Wang*, Dong Nian Cheng
• Keywords: Anomaly Score, Encrypted Traffic Identification, Protocol Fingerprints, Skype

References

[1] CNNIC. http: /www. cnnic. net. cn. 2013-06.

[2] Madhukar A, Williamson C. A longitudinal study of P2P traffic classification[C]/Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, 2006. MASCOTS 2006. 14th IEEE International Symposium on. IEEE, 2006: 179-188.

DOI: 10.1109/mascots.2006.6

[3] Bonfiglio D, Mellia M, Meo M, et al. Revealing skype traffic: when randomness plays with you[C]/ACM SIGCOMM Computer Communication Review. ACM, 2007, 37(4): 37-48.

DOI: 10.1145/1282427.1282386

[4] Dainotti A, Pescape A, Claffy K C. Issues and future directions in traffic classification[J]. Network, IEEE, 2012, 26(1): 35-40.

DOI: 10.1109/mnet.2012.6135854

[5] Wright C, Monrose F, Masson G M. HMM profiles for network traffic classification[C]/Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security. ACM, 2004: 9-15.

DOI: 10.1145/1029208.1029211

[6] Moore A W, Zuev D. Internet traffic classification using bayesian analysis techniques[C]/ACM SIGMETRICS Performance Evaluation Review. ACM, 2005, 33(1): 50-60.

DOI: 10.1145/1071690.1064220

[7] Alshammari R, Zincir-Heywood N. Generalization of signatures for ssh encrypted traffic identification[C]/Computational Intelligence in Cyber Security, 2009. CICS'09. IEEE Symposium on. IEEE, 2009: 167-174.

DOI: 10.1109/cicybs.2009.4925105

[8] Alshammari R, Zincir-Heywood A N. Machine learning based encrypted traffic classification: identifying SSH and skype[C]/Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on. IEEE, 2009: 1-8.

DOI: 10.1109/cisda.2009.5356534

[9] Baset S A, Schulzrinne H. An analysis of the skype peer-to-peer internet telephony protocol[J]. arXiv preprint cs/0412017, (2004).

DOI: 10.1109/infocom.2006.312

[10] Suh K, Figueiredo D R, Kurose J, et al. Characterizing and detecting relayed traffic: A case study using Skype[C]/IEEE Infocom. 2006, 6.

DOI: 10.1109/infocom.2006.313

[11] Bonfiglio D, Mellia M, Meo M, et al. Tracking down skype traffic[C]/INFOCOM 2008. The 27th Conference on Computer Communications. IEEE. IEEE, 2008: 261-265.

DOI: 10.1109/infocom.2008.61

[12] Alshammari R, Zincir-Heywood A N. Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?[J]. Computer Networks, 2011, 55(6): 1326-1350.

DOI: 10.1016/j.comnet.2010.12.002

[13] Crotti M, Dusi M, Gringoli F, et al. Detecting http tunnels with statistical mechanisms[C]/Communications, 2007. ICC'07. IEEE International Conference on. IEEE, 2007: 6162-6168.

DOI: 10.1109/icc.2007.1020

[14] Crotti M, Dusi M, Gringoli F, et al. Traffic classification through simple statistical fingerprinting[J]. ACM SIGCOMM Computer Communication Review, 2007, 37(1): 5-16.

DOI: 10.1145/1198255.1198257

[15] Okabe T, Kitamura T, Shizuno T. Statistical traffic identification method based on flow-level behavior for fair VoIP service[C]/VoIP Management and Security, 2006. 1st IEEE Workshop on. IEEE, 2006: 35-4.

DOI: 10.1109/voipms.2006.1638120