A temporal-aware signature extraction method using sliding-window mechanism for scalable, cost-effective and accurate traffic classification

Payload-based traffic classification use a subset of highly correlated payload bytes as signature to identify unlabeled traffic classes. However, these correlations diminish over time due to application behavioural changes, resulting in lower true positive in subsequent classifications. The short time-to-live of signatures means that signatures can become outdated quickly, and new set of signatures are needed to preserve classification accuracy. Extracting new signatures is computational expensive and not scalable to these continuous behavioural changes. This paper proposed a lightweight automatic signature extraction method that adaptively recalibrate the signature sets to reflect behavioural transitions using sliding-window mechanism. The algorithm use Leviathan Distance to detect the optimal number of payload bytes (K) needed to uniquely discriminate traffic classes. Sliding-k then shrink or expand the k value of the base signature to address for temporal changes instead of rebuilding new signatures completely. The experimental results showed that sliding-k is effective in reducing signature length while preserving classification accuracy for continuous traffic classification.