Deep Packet Inspection Techniques Research Articles

Enabling locality-sensitive machine learning towards low predictive overhead in flow classification

The expansion of computer networks and the proliferation of their applications have heightened the necessity for accurate network traffic identification to enhance resource allocation and mitigate congestion, emphasizing flow classification’s pivotal role. Traditional methods, notably deep packet inspection, have encountered challenges due to the rise in encrypted traffic, diminishing their efficacy. In response, machine learning approaches, including decision trees, have been adopted for their ability to classify flows without necessitating access to the payload, thereby enhancing classification efficiency. Nonetheless, these machine learning-based models introduce considerable overhead in category determination. To address this issue, this paper introduces a locality-sensitive flow classification (LSFC) method, leveraging locality-sensitive hashing to efficiently partition and group traffic, thereby expediting the classification process and minimizing overhead. LSFC adeptly balances classification accuracy and processing delay, catering to the specific demands of various scenarios. Comprehensive evaluations demonstrate that LSFC significantly outperforms traditional machine learning models in inference speed by over 50% and improves upon deep packet inspection techniques in handling encrypted traffic, achieving a reduction in classification delay exceeding 15% without compromising classification accuracy.

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

Network traffic control and classification have become increasingly dependent on deep packet inspection (DPI) approaches, which are the most precise techniques for intrusion detection and prevention. However, the increasing traffic volumes and link speed exert considerable pressure on DPI techniques to process packets with high performance in restricted available memory. To overcome this problem, we proposed dual cuckoo filter (DCF) as a data structure based on cuckoo filter (CF). The CF can be extended to the parallel mode called parallel Cuckoo Filter (PCF). The proposed data structure employs an extra hash function to obtain two potential indices of entries. The DCF magnifies the superiority of the CF with no additional memory. Moreover, it can be extended to the parallel mode, resulting in a data structure referred to as parallel Dual Cuckoo filter (PDCF). The implementation results show that using the DCF and PDCF as identification tools in a DPI system results in time improvements of up to 2% and 30% over the CF and PCF, respectively.

Elephant Flows Detection Using Deep Neural Network, Convolutional Neural Network, Long Short-Term Memory, and Autoencoder

Currently, the widespread of real-time applications such as VoIP and videos-based applications require more data rates and reduced latency to ensure better quality of service (QoS). A well-designed traffic classification mechanism plays a major role for good QoS provision and network security verification. Port-based approaches and deep packet inspection (DPI) techniques have been used to classify and analyze network traffic flows. However, none of these methods can cope with the rapid growth of network traffic due to the increasing number of Internet users and the growth of real-time applications. As a result, these methods lead to network congestion, resulting in packet loss, delay, and inadequate QoS delivery. Recently, a deep learning approach has been explored to address the time-consumption and impracticality gaps of the abovementioned methods and maintain existing and future traffics of real-time applications. The aim of this research is then to design a dynamic traffic classifier that can detect elephant flows to prevent network congestion. Thus, we are motivated to provide efficient bandwidth and fast transmission requirements to many Internet users using SDN capability and the potential of deep learning. Specifically, DNN, CNN, LSTM, and Deep autoencoder are used to build elephant detection models that achieve an average accuracy of 99.12%, 98.17%, and 98.78%, respectively. Deep autoencoder is also one of the promising algorithms that do not require human class labeler. It achieves an accuracy of 97.95% with a loss of 0.13. Since the loss value is closer to zero, the performance of the model is good. Therefore, the study has a great importance to Internet service providers, Internet subscribers, as well as for future researchers in this area.

A comprehensive survey on deep packet inspection for advanced network traffic analysis: issues and challenges

Deep Packet Inspection (DPI) provides full visibility into network traffic by performing detailed analysis on both packet header and packet payload. Accordingly, DPI has critical importance as it can be used in applications i.e network security or government surveillance. In this paper, we provide an extensive survey on DPI. Different from the previous studies, we try to efficiently integrate DPI techniques into network analysis mechanisms by identifying performance-limiting parameters in the analysis of modern network traffic. Analysis of the network traffic model with complex behaviors is carried out with powerful hybrid systems by combining more than one technique. Therefore, DPI methods are studied together with other techniques used in the analysis of network traffic. Security applications of DPI on Internet of Things (IoT) and Software-Defined Networking (SDN) architectures are discussed and Intrusion Detection Systems (IDS) mechanisms, in which the DPI is applied as a component of the hybrid system, are examined. In addition, methods that perform inspection of encrypted network traffic are emphasized and these methods are evaluated from the point of security, performance and functionality. Future research issues are also discussed taking into account the implementation challenges for all DPI processes.

Threat Intelligence Generation Using Network Telescope Data for Industrial Control Systems

Industrial Control Systems (ICSs) are cyber-physical systems that offer attractive targets to threat actors due to the scale of damages, both physical and cyber, that successful exploitation can cause. As such, ICSs often find themselves victims to reconnaissance campaigns - coordinated scanning activity that targets a wide subset of the Internet - that aim to discover vulnerable systems. As these campaigns likely scan broad netblocks of the Internet, some traffic is directed to network telescopes, which are routable, allocated, and unused IP space. In this paper, we explore the threat landscape of ICS devices by analyzing and investigating network telescope traffic. Our network traffic analysis tool takes darknet traffic and generates threat intelligence on scanning campaigns targeting ICSs in the form of campaign fragments, which we leverage in new ways to get more in-depth knowledge of the cybersecurity threats. We investigate the payloads of the identified campaigns using a custom Deep Packet Inspection (DPI) technique to dissect and analyze the packets. We found 13 distinct payload templates and deduced their purpose, and by extension the campaign goals. We use machine learning to classify the sources behind the campaigns and identify threat actors such as botnets, malicious attackers, or researchers, and establish a methodology to rank our campaigns to prioritize our analysis. To conduct our analysis of the threats targeting ICSs, we have leveraged 12.85 TB (330 days) of network traffic received by our observed darknet IP space. Combining these investigative threads, we provide a thorough overview of the threat landscape targeting ICS systems.

Application layer classification of Internet traffic using ensemble learning models

SummaryAccurate application layer classification of Internet traffic has been a necessary requirement for various regulatory, control, and operational purposes of Internet service provider (ISP). Due to the dynamic and ever evolving nature of Internet applications generating a diverse mixture of Internet traffic, it has been necessary to apply deep packet inspection (DPI) techniques for traffic classification. DPI methods offer accuracy but degrade overall network throughput and thus cause problems in ensuring quality of service (QoS) and maintaining service‐level agreements. Moreover, Internet traffic is mostly end to end encrypted. This in turn limits the applicability of DPI techniques and renders them useless, unless the encryption tunnel is broken by the service provider which would risk violating user privacy. To address these trade‐offs between classification accuracy, performance, and user privacy, we resort to machine learning (ML)‐based algorithms. In this article, we apply three ensemble ML algorithms and report their performance metrics in the application layer classification of Internet traffic.

STCS: Spatial-Temporal Collaborative Sampling in Flow-Aware Software Defined Networks

General traffic analysis based on deep packet inspection (DPI) techniques at switches cannot grasp the detailed knowledge of network applications going into internal switches, and the statistics-based reports of switches lack flow-level recognition of the traffic. Besides, DPI is generally expensive and has limited performance. Therefore, network-wise accurate flow-awareness by packet sampling is highly desirable for fine-grained quality of service guarantee, internal network management, traffic engineering, security analysis, and so on. In this paper, we propose a Spatial-Temporal Collaborative Sampling (STCS) framework in the flow-aware software-defined networks (SDNs). Particularly, considering the spatial-temporal factors and limits of network resources, the formulated STCS problem aims to maximize the network-wise sampling accuracy of flows including mice flows and elephant flows by characterizing both of the comprehensive influences of switches and the effects on sampling accuracy imposed by the collaborative strategy among switches in the spatial-temporal dimension. We propose a suboptimal approach to address the complex STCS problem in two steps: 1) Top-K switch selection based on the iterative comprehensive influence, and 2) sampling time slot allocation based on the local value maximization. Trace-driven evaluation results demonstrate the effectiveness of the proposed framework on improving the sampling accuracy and reducing redundant packets.

Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks

The proliferation of handheld devices has led to an explosive growth of mobile traffic volumes on the Internet. Identifying mobile apps from network traffic has become a crucial task for mobile network management and security. Traditionally, the design of accurate identifiers relies on the deep packet inspection (DPI) techniques. However, such approaches have become less effective with the raising adoption of encrypted protocols in mobile applications (mostly TLS). To address the problem, various machine learning methods have been studied and used. Most of them use linear classifiers on top of hand-engineered features, which are unreliable due to the complexity of mobile traffic. In this article we propose App-Net, an end-to-end hybrid neural network for mobile app identification from encrypted TLS traffic. App-Net is designed by combining RNN and CNN in a parallel way and can automatically learn effective features from raw TLS flows. With coordinated fusion and optimized training, the hybrid and multimodal architecture is able to characterize both flow sequence patterns and app signatures to learn a joint flow-app embedding. We evaluate App-Net on a real-world dataset covering 80 apps. The results show that our method can achieve an excellent performance and outperform the state-of-the-art methods.

IMPLEMENTASI TEKNIK DEEP PACKET INSPECTION DENGAN MENGGUNAKAN WIRESHARK PADA SISTEM OPERASI UBUNTU

Deep Packet Inspection (DPI) is a technique commonly used by network administrator to be able to monitor in detail the flow of data in the form of data packets that occur at that moment. This data stream will produce an information that can be used for network management purposes. One example of a case study that can be done with this technique is the intranet that is available in Information Technology major Udayana University’s. Deep Packet Inspection Technique is done with purpose to identifying the initial slowing down of network speed on Information Technology major Udayana University’s.

QCF for deep packet inspection

Deep packet inspection (DPI) acts as a tool to control and classify incoming network traffic depending on users,content, applications and becomes a very important aspect of every network today. Instead of utilising only incoming packet header information, Internet service providers utilise DPI for security purposes, flow management, and routing. The high-performance challenges that face DPI techniques to manage line-speed packet processing with restricted available memory are the increasing traffic volumes and link rates. Bloom (BF) and quotient (QF) filters are effective randomised data structures for performing approximate membership queries. They have been employed in many networking applications including DPI. Nevertheless, they consume more calculations which degrade the system performance. Consequently, in this paper, the authors propose a new variant of membership query data structure, called quotient-based Cuckoo filter (QCF), that reflects a merging process between QF and CF to minimise the calculation overhead and employing it in a DPI system. QCF employs only two hash functions and consumes less calculation overhead than BF, QF, and CF. The implementation results show that using QCF as an identification tool in a DPI system result in a time improvement up to 77% over CF and up to 98% over BF and QF.

Fast 2D filter with low false positive for network packet inspection

Deep packet inspection (DPI) represents the major process in network intrusion detection and prevention systems. In DPI each security threat is represented as a signature, and the payload of every incoming data packet is matched against the set of current signatures. Moreover, DPI is also used for other networking applications such as packet classification, quality of service techniques, protocol identification and so on. DPI exhausts extra central processing unit and memory resources, and as a result, several attempts have been proposed to improve this process. In this study, the authors proposed a fast two-dimensional (2D) filter with low false positive (FP) rate for DPI purposes. It consists of 2D array that employs single hash function and has very low FP rate. Using this filter as an identification tool in a DPI technique will result in more accurate and higher throughput than other systems that employ Bloom (BFs) and quotient filters (QFs). Our experiments show that the proposed solution has time improvement up to 94% over others that employ BFs or QFs and the achieved average throughput is 1.8 Gbps.

The Investigation and Development Status of Deep Packet Inspection

The network security is an important issue in the Development of the Internet of Things (IoT). For detecting and defending the network attacks, the deep packet inspection is a promising technology that attracts the research and development attentions from the universities and industries. This paper overviews the investigations and development status of the deep packet inspection technology and summarizes different deep packet inspection techniques. Moreover, the paper also presents our investigations on the deep packet inspection and the related works.

Length-Bounded Hybrid CPU/GPU Pattern Matching Algorithm for Deep Packet Inspection

Since frequent communication between applications takes place in high speed networks, deep packet inspection (DPI) plays an important role in the network application awareness. The signature-based network intrusion detection system (NIDS) contains a DPI technique that examines the incoming packet payloads by employing a pattern matching algorithm that dominates the overall inspection performance. Existing studies focused on implementing efficient pattern matching algorithms by parallel programming on software platforms because of the advantages of lower cost and higher scalability. Either the central processing unit (CPU) or the graphic processing unit (GPU) were involved. Our studies focused on designing a pattern matching algorithm based on the cooperation between both CPU and GPU. In this paper, we present an enhanced design for our previous work, a length-bounded hybrid CPU/GPU pattern matching algorithm (LHPMA). In the preliminary experiment, the performance and comparison with the previous work are displayed, and the experimental results show that the LHPMA can achieve not only effective CPU/GPU cooperation but also higher throughput than the previous method.

Deep Packet Inspection Using Quotient Filter

Deep packet inspection (DPI) plays a central role in modern networks. Specifically, content providers need a way to monitor the traffic that enters and leave their datacenters. Most DPI techniques depend on using a predefined set of signatures in the packet payload. This matching process consumes a lot of memory and CPU resources, and thus, many researchers try to enhance this process. In this letter, we show how DPI can be accelerated by using a technique that makes use of quotient filter. Our experiments show that our solution achieves a higher throughput (from 30% to 75%) than others that use Bloom filter, when implemented in software.

Internet traffic classification based on flows' statistical properties with machine learning

SummaryMachine learning has recently entered the area of network traffic classification as an alternative to the deep packet inspection technique. It provides both unsupervised and supervised learning algorithms that are capable to put aside similar types of traffic or recognize Internet protocols based on some training, pre‐labeled samples. The current work proposes a new approach in the area of network traffic classification using machine learning. First, we extract the unidirectional and bidirectional flows from a traffic capture. A flow is a collection of packets that share sender and receiver IP address and port. Second, we select relevant statistical properties of these flows and use an unsupervised learning mechanism to group flows into clusters based on the similarities. Eventually, we use this classification as training input for a supervised learning engine that will have to properly determine the class of new, unseen traffic flows. Copyright © 2016 John Wiley & Sons, Ltd.

Deep packet inspection tools and techniques in commodity platforms: Challenges and trends

Deep packet inspection (DPI) helps Internet service providers in efforts to profile networked applications. By relying on DPI systems, Internet service providers may apply different charging policies, traffic shaping, or offer quality of service (QoS) guarantees to selected users or applications. As critical network services rely on the precise characterization of network flows, building agile and efficient DPI systems has recently become an important research topic. In this paper, we present a comprehensive literature review on the tools and techniques necessary to develop modern DPI systems. We provide the essential technical background material and examine the current body of research in DPI engines’ optimization for commodity platforms. Then we discuss current research challenges and present guidelines for building high performance DPI systems.

Policing the Network: Using DPI for Copyright Enforcement

Deep Packet Inspection (DPI) and other network surveillance techniques have become important factors in the policy debate over online copyright infringement. These new technical capabilities reopened an old debate about the responsibility of internet service providers (ISPs) for policing the internet. This paper attempts to understand the extent to which new technological capabilities have the power to alter regulatory principles. It examines political conflict and negotiation over proposals to use DPI for online copyright enforcement in the EU and the USA, using a hybrid of actor-network theory from science, technology and society studies and actor-centered institutionalism in political science. It shows that while the technology disrupted a policy equilibrium, neither the EU nor the US applied DPI to copyright policing in a way that realized its radical potential. The key factor preventing such an integrated response was the disjunction between the interests of network operators and the interests of copyright holders.

Internet Traffic Classification Using the Index of Variability

Internet Traffic Classification aims at the identification of the Internet application that generates a given sequence of packets. Shallow Packet Inspection (SPI) is a new family of classification techniques that only use information available in the external header of packets and the statistical characterization of the traffic process. Therefore, these techniques are applicable even to encrypted or obfuscated traffic. The packet arrival process is a particularly interesting features for traffic classification, as it is difficult to significantly modify it. This paper proposes a classification technique based on a classification feature called Index of Variability, which evaluates the traffic source burstiness over various time scales in order to discriminate among different classes of Internet applications. Experimental results show that this classification method operates effectively both on synthetic and real traffic traces. Synthetic traffic traces make it possible to estimate the classification error rate achieved by the classification algorithm. The usage of real traces allows us to compare the performance of the method to the performance obtained with Deep Packet Inspection (DPI) techniques, showing that SPI and DPI yields similar results.

Extracting user web browsing patterns from non-content network traces: The online advertising case study

Online advertising is a rapidly growing industry currently dominated by the search engine ’giant’ Google. In an attempt to tap into this huge market, Internet Service Providers (ISPs) started deploying deep packet inspection techniques to track and collect user browsing behavior. However, these providers have the fear that such techniques violate wiretap laws that explicitly prevent intercepting the contents of communication without gaining consent from consumers. In this paper, we explore how it is possible for ISPs to extract user browsing patterns without inspecting contents of communication. Our contributions are threefold. First, we develop a methodology and implement a system that is capable of extracting web browsing features from stored non-content based network traces, which could be legally shared. When such browsing features are correlated with information collected by independently crawling the Web, it becomes possible to recover the actual web pages accessed by clients. Second, we evaluate our system on the Internet and check that it can successfully recover user browsing patterns with high accuracy.

Optimizing Deep Packet Inspection for High-Speed Traffic Analysis

Deep Packet Inspection (DPI) techniques are considered extremely expensive in terms of processing costs and therefore are usually deployed in edge networks, where the amount of data to be processed is limited. This paper demonstrates that, in case the application can tolerate some compromises in terms of accuracy (such as many measurement-based tasks) and in presence of normal traffic, the processing cost can be greatly reduced while even improving the classification precision, making DPI suitable also for high-speed networks.