A statistical framework for identification of tunnelled applications using machine learning
Joint Authors
Source
The International Arab Journal of Information Technology
Issue
Vol. 12, Issue 6A(s) (31 Dec. 2015)6 p.
Publisher
Publication Date
2015-12-31
Country of Publication
Jordan
No. of Pages
6
Main Subjects
Topics
Abstract EN
This work describes a statistical approach to detect applications which are running inside application layer tunnels.
Application layer tunnels are a significant threat for network abuse and violation of acceptable internet usage policy of an organisation.
In tunnelling, the prohibited application packets are encapsulated as payload of an allowed protocol packet.
It is much difficult to identify tunnelling using conventional methods in the case of encrypted HTTPS tunnels, for example.
Hence, machine learning based approach is presented in this work in which statistical packet stream features are used to identify the application inside a tunnel.
Packet Size Distribution (PSD) in the form of discrete bins is an important feature which is shown to be indicative of the respective application.
This work presents a combination of other features with the PSD bins for better identification of the applications.
Tunnelled applications are identifiable using these traffic statistical parameters.
A comparison of the performance accuracy of five machine learning algorithms for application detection using this feature set is also given.
American Psychological Association (APA)
Mujtaba, Ghulam& Parish, David. 2015. A statistical framework for identification of tunnelled applications using machine learning. The International Arab Journal of Information Technology،Vol. 12, no. 6A(s).
https://search.emarefa.net/detail/BIM-655036
Modern Language Association (MLA)
Mujtaba, Ghulam& Parish, David. A statistical framework for identification of tunnelled applications using machine learning. The International Arab Journal of Information Technology Vol. 12, no. 6A (Dec. 2015).
https://search.emarefa.net/detail/BIM-655036
American Medical Association (AMA)
Mujtaba, Ghulam& Parish, David. A statistical framework for identification of tunnelled applications using machine learning. The International Arab Journal of Information Technology. 2015. Vol. 12, no. 6A(s).
https://search.emarefa.net/detail/BIM-655036
Data Type
Journal Articles
Language
English
Notes
Includes appendix.
Record ID
BIM-655036