Characterization, estimation and detection of network application traffic

The classification of Internet traffic is of interest in areas like differentiated services and network security. Such classification is usually done using the packet header field of `port number'. However, recent developments in networking techniques have rendered the port numbers unreliable for this purpose. Our scheme of classification uses the distribution of packet sizes in a buffer or collected during a short time interval at a switch or router. We demonstrate that applications can be classified by these distributions and, estimations of the amount of each application is possible. We compare three methods for estimation of the traffic in various applications; MMSE estimation, POCS and neural networks. Detection of the presence of individual applications can be done reliably. Methods that use artificial neural networks performed best in our tests.