By Topic

A framework for tunneled traffic analysis

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

2 Author(s)
Taner Yildirim ; School of Electrical & Computer Engineering, RMIT University, Australia ; PJ Radcliffe

Research in traffic classification is reaching into ever more difficult areas. Traditional techniques such as header and payload inspection are not providing sufficient information due to usage of non-standard ports and encryption. Promising alternative methods have been proposed based on the statistical behaviour of traffic flows. Although these methods can achieve quite high accuracies in non-encrypted traffic flows, traffic identification of encrypted traffic flows is still in its early stages. We argue that the results to date for encrypted traffic cannot help a network device such as a firewall make any useful decision, nor are there any indications that this may be achieved in the future. We propose a novel approach to cope with encrypted peer to peer network layer tunnels which are a particular problem in schools, universities, and larger corporate networks. First statistical techniques are used to identify the protocols present, a process that may take in the order of seconds. Next, based on the protocols discovered, and enterprise policies, a network device is advised to block, band-limit, or allow the whole tunnel, or a range of packet sizes within that tunnel. Preliminary research has concluded that VoIP traffic can be successfully handled by this approach and that advise to a network device can be practically useful. Work continues to apply these techniques to other protocols and mixes of protocols within a peer to peer tunnels.

Published in:

Advanced Communication Technology (ICACT), 2010 The 12th International Conference on  (Volume:2 )

Date of Conference:

7-10 Feb. 2010