Rapid identification of Skype traffic flows

In this paper we present results of experimental work using machine learning techniques to rapidly identify Skype traffic. We show that Skype traffic can be identified by observing 5 seconds of a Skype traffic flow, with recall and precision better than 98%. We found the most effective features for classification were characteristic packet lengths less than 80 bytes, statistics of packet lengths greater than 80 bytes and inter-packet arrival times. Our classifiers do not rely on observing any particular part of a flow. We also report on the performance of classifiers built using combinations of two of these features and of each feature in isolation. Categories and Subject Descriptors C.2.3 [Network Operations]: Network Monitoring, Public Networks General Terms Algorithms, Measurement, Experimentation Keywords Skype, Traffic classification, Machine learning

• Type: Conference
• Year: 2009
• Where: NOSSDAV
• Authors: Philip Branch, Amiel Heyde, Grenville J. Armitage
• Keywords: NOSSDAV 2009, Operating System, Packet Lengths, Skype Traffic, Skype Traffic Flow