Topic-model based Automatic Signature Extraction of Internet Applications

Abstract

Classifying network traffic according to the application that generated it has attracted significant interests among Internet researchers and operators, as it is an essential task for understanding, operating, optimizing, planning, and financing the Internet. Although content-analysis based Deep Packet (Payload) Inspection technique has been found very accurate once given a set of known payload signature strings for corresponding applications, it is very time consuming and challenging to manually derive and construct the signatures. In this paper, we propose a new, automatic payload content-analysis based traffic classification method called TASTE(Topic-model based Automatic Signature Extraction). TASTE adopts the Latent Dirichlet Allocation (LDA) topic model, which is one of the most popular probabilistic text modeling techniques for extracting latent semantic information from text corpa. Our evaluation with a broad range of data sets demonstrates that TASTE can automatically detect and identify signatures for a range of applications without any prior knowledge, with 96-98% of overall accuracy.