KISS: Stochastic Packet Inspection Classifier for UDP Traffic

Abstract--This paper proposes KISS, a novel Internet classification engine. Motivated by the expected raise of UDP traffic, which stems from the momentum of P2P streaming applications, we propose a novel classification framework which leverages on statistical characterization of payload. Statistical signatures are derived by the means of a Chi-Square like test, which extracts the protocol "format", but ignores the protocol "semantic" and "synchronization" rules. The signatures feed a decision process based either on the geometric distance among samples, or on Support Vector Machines. KISS is very accurate, and its signatures are intrinsically robust to packet sampling, reordering, and flow asymmetry, so that it can be used on almost any network. KISS is tested in different scenarios, considering traditional client-server protocols, VoIP and both traditional and new P2P Internet applications. Results are astonishing. The average True Positive percentage is ...

• Type: Journal
• Year: 2010
• Where: TON
• Authors: Aleaandro Finamore, Marco Mellia, Michela Meo, Dario Rossi
• Keywords: P2P Streaming Applications, Signatures, TON 2010, True Positive Percentage