Traffic classification based on port connection pattern

While the traditional Web, Email and other Internet applications are still used large-scale, Internet applications, such as typical P2P resource sharing, streaming, games, instant messaging and other new applications emerging, is generating the rapid growth traffic. Connection pattern approach is to observe and identify connection patterns of host behavior at the transport layer. This method has no access to packet payload, no knowledge of port numbers and no additional information other than what current flow collectors provide. But traffic classification method based on host connection pattern can't distinguish some similar applications provided by one server. This paper analyzes the connection pattern between servers for SMTP, POP3, Web, BT traffic, and the distribution of simultaneous connections for each server port, and then propose a new traffic classified approach based on port connection pattern and the simultaneous connection number. The classified method can distinguish WEB, SMTP, POP3, and BT traffic each port in a server without any knowledge of port. The experimental result shows that this method is effective.