Discriminating Internet Applications based on Multiscale Analysis

In the last few years, several new IP applications and protocols emerged as the capability of the networks to provide new services increased. The rapid increase in the number of users of peer-to-peer (P2P) network applications, due to the fact that users are easily able to use network resources over these overlay networks, also lead to a drastic increase in the overall Internet traffic volume. An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. This paper presents a novel framework for identifying IP applications based on the multiscale behavior of the generated traffic: by performing clustering analysis over the multiscale parameters that are inferred from the measured traffic, we are able to efficiently differentiate different IP applications. Besides achieving accurate identification results, this approach also avoids some of the limitations of existing identification techniques, namely their inability do deal with stringent confidentiality requirements.