Search

Network traffic classification has many applications, such as security monitoring, quality of service, traffic engineering, and so on. For the aforementioned applications, Deep Packet Inspection (DPI) is a popularly used technique for traffic classification because it scrutinizes the payload and provides comprehensive information for accurate analysis of network traffic. However, DPI-based methods reduce network performance because they are computationally expensive and hinder end-user privacy as they analyze the payload. To overcome these challenges, bit-level signatures are significantly used to perform network traffic classification. However, most of these methods still need to improve performance as they perform one-by-one signature matching of unknown payloads with application signatures for classification. Moreover, these methods become stagnant with the increase in application signatures. Therefore, to fill this gap, we propose OptiClass, an optimized classifier for application protocols using bit-level signatures. OptiClass performs parallel application signature matching with unknown flows, which results in faster, more accurate, and more efficient network traffic classification. OptiClass achieves twofold performance gains compared to the state-of-the-art methods. First, OptiClass generates bit-level signatures of just 32 bits for all the applications. This keeps OptiClass swift and privacy-preserving. Second, OptiClass uses a novel data structure called BiTSPLITTER for signature matching for fast and accurate classification. We evaluated the performance of OptiClass on three datasets consisting of twenty application protocols. Experimental results report that OptiClass has an average recall, precision, and F1-score of 97.36%, 97.38%, and 97.37%, respectively, and an average classification speed of 9.08 times faster than five closely related state-of-the-art methods. [ABSTRACT FROM AUTHOR]

Background: Jacob's disease is a rare pathology characterized by elongation/ enlargement of coronoid process of mandible with formation of pseudoarticulation with zygomatic arch. It presents clinically as restricted mouth opening and is often misdiagnosed as temporomandibular joint pathology. Case Presentation: We performed cross sectional imaging and evaluation of Jacob's disease in a 14-year-old girl with restricted mouth opening, CT images including Multiplanar Reconstruction and Volume Rendered Technique revealed enlarged left coronoid process of mandible while open mouth CT images and MR images concluded the presence of joint between enlarged coronoid process and zygomatic arch. Conclusions: Coronoid process hypertrophy and Jacob's disease are important differentials which should be considered in evaluation of restricted mouth opening. We propose that apart from CT, MR imaging should be considered in such cases for better pre-operative evaluation of joint formation. [ABSTRACT FROM AUTHOR]

With many network protocols using obfuscation techniques to hide their identity, robust methods of traffic classification are required. In traditional deep-packet-inspection (DPI) methods, application specific signatures are generated with byte-level data from payload. Increasingly new data formats are being used to encode the application protocols with bit-level information which render the byte-level signatures ineffective. In this paper, we describe BitCoding a bit-level DPI-based signature generation technique. BitCoding uses only a small number of initial bits from a flow and identify invariant bits as signature. Subsequently, these bit signatures are encoded and transformed into a newly defined state transition machine transition constrained counting automata. While short signatures are efficient for processing, this will increase the chances of collision and cross signature matching with increase in number of signatures (applications). We describe a method for signature similarity detection using a variant of Hamming distance and propose to increase the length of signatures for a subset of protocols to avoid overlaps. We perform extensive experiments with three different data sets consisting of 537 380 flows with a packet count of 3 445 969 and show that, BitCoding has very good detection performance across different types of protocols (text, binary, and proprietary) making it protocol-type agnostic. Further, to understand the portability of signatures generated we perform cross evaluation, i.e., signatures generated from one site are used for testing with data from other sites to conclude that it will lead to a small compromise in detection performance. [ABSTRACT FROM AUTHOR]