Geza Szabo

Accurate Traffic Classification

The analysis of network traffic can provide important information for network operators and administrators. One of the main purposes of traffic analysis is to identify the traffic mixture the network carries. A couple of different approaches have been proposed in the literature, but none of them performs well for all different application traffic types present in the Internet. Thus, a combined method that includes the advantages of different approaches is needed, in order to provide a high level of classification completeness and accuracy. According to our best knowledge, this study is the first attempt where the currently known traffic classification methods are benchmarked on network traces captured in operational mobile networks. The pros and cons of the classification methods are analyzed, based on the experienced accuracy for different types of applications. Using the gained knowledge about the strengths and weaknesses of the existing approaches, a novel traffic classification method is proposed. The novel method is based on a complex decision mechanism, in order to provide an appropriate identification mode for each different application type. As a consequence, the ratio of the unclassified traffic becomes significantly lower. Further, the reliability of the classification improves, as the various methods validate the results of each other. The novel method is tested on several network traces, and it is shown that the proposed solution improves both the completeness and the accuracy of the traffic classification, when compared to existing methods.

On the validation of traffic classification algorithms

Detailed knowledge of the traffic mixture is essential for network operators and administrators, as it is a key input for numerous network management activities. Traffic classification aims at identifying the traffic mixture in the network. Several different classification approaches can be found in the literature. However, the validation of these methods is weak and ad hoc, because neither a reliable and widely accepted validation technique nor reference packet traces with well-defined content are available. In this paper, a novel validation method is proposed for characterizing the accuracy and completeness of traffic classification algorithms. The main advantages of the new method are that it is based on realistic traffic mixtures, and it enables a highly automated and reliable validation of traffic classification. As a proof-of-concept, it is examined how a state-of-the-art traffic classification method performs for the most common application types.

Deterministic Finite Automaton for scalable traffic identification: The power of compressing by range

Deep Packet Inspection (DPI) systems have been becoming an important element in traffic measurement ever since port-based classification was deemed no longer appropriate, due to protocol tunneling and misuses of well-defined ports. Current DPI systems express application signatures using regular expressions and it is usual to perform pattern matching through the use of Finite Automaton (FA). Although DPI systems are essentially more accurate, they are also resource-intensive and do not scale well with link speeds. Looking to this area of interest, this paper proposes a novel Deterministic Finite Automaton, called Ranged Compressed Deterministic Finite Automaton (RCDFA), that compresses transitions without additional memory lookups. Experimental results show that RCDFA yields space savings of 97% over the original DFA and up to 93% better compression when compared to the DFAs state-of-the-art compression techniques.

How to validate traffic generators

Network traffic generators are widely used in networking research and they are validated by a very broad range of metrics (mainly traffic characteristics). In this paper we overview the state of the art of these metrics and unveil that there is no consensus in the research community how to validate these traffic generators and which metric to choose for validation purpose. This situation makes it extremely difficult to evaluate validation results and compare different traffic generators. We advocate the research for finding a common set of metrics for the validation and comparative evaluation of traffic generators.

High-Performance Traffic Workload Architecture for Testing DPI Systems

Traffic identification and classification are essential tasks performed by Internet Service Provider (ISPs) administrators. Deep Packet Inspection (DPI) is currently playing a key role in traffic identification and classification due to its increased expressive power. To allow fair comparison among different DPI techniques and systems, workload generators should have the following characteristics: (i) synthetic packets with meaningful payloads; (ii) TCP and UDP traffic generation; (iii) a configurable network traffic profile, and (iv) a high-speed sending rate. This paper proposes a workload generator framework which inherits all of the above characteristics. A performance evaluation shows that our flexible workload generator system achieves very high sending rates over a 10Gbps network, using a commodity Linux machine. Additionally, we have configured and tested our workload generator following a real application traffic profile. We then analyzed its results within a DPI system, proving its accuracy and efficiency.

Media QoE enhancement With QUIC

The demonstrated system is an online video streaming service using QUIC protocol as transport. Video buffer status information is gathered at the client side and it is transferred to the video content server via the object priority assignment method of QUIC. Our proposal is to utilize the priority information for congestion control (CC) influence as well. In our realization, the server extracts the priority information and utilizes it to adjust the aggressiveness level of the CC of TCP emulation in QUIC. The measured gain in initial buffering time (IBT) in the demonstrated system is in the range of 6-49% depending on the video properties and network environment. [1] shows the demonstration.

User behavior based traffic emulator: A framework for generating test data for DPI tools

Abstract Deep Packet Inspection (DPI) engines rely highly on the operation environment i.e., the traffic mix they supposed to work with. A well performing DPI engine requires real-world traffic mixes to be tested on. Due to privacy issues real-world traffic is usually only available at the site of the network operator at a secure measurement point. Furthermore, in order to make signature update, performance tweaks, etc. of the DPI engine, real-like measurements are essential. In this paper we present a traffic generation framework that provides up-to-date traffic mixes continuously. The basic idea of the framework is to generate traffic based on automatic user behavior emulation. Real-world traffic measurements are processed to analyze and extract the most typical user behavior scenarios. Our proposed method uses these typical user behaviors for emulation of users on remote controlled hosts while the network traffic of the user equipment is recorded. As a final step, the framework can build high-speed multiplexed traces from the recorded data which mimic the behavior of real traffic. The characteristics of the constructed traffic compared to real world traffic measurements are also evaluated in the paper showing that the framework is able to generate realistic traffic traces that are both suitable for DPI testing and can be publicly distributed without any privacy concerns. The proof of concept implementation of the presented system is open to the public [1].

Multi-functional emulator for traffic analysis

We present the versatile functionality of our novel user behavior based traffic emulation system in this paper. We show the unique feature of the system, i. e., it is capable of working on different platforms (Windows, Android), on different access technologies (wired, WiFi, 3G) and as a remote controlled system on different sites (Europe, Asia, South America). Our examples exhibit some of the manifold traffic analysis possibilities as a result of this key functionality. We have also made our system available to the public [1].

Multi-gigabit traffic identification on GPU

Traffic Identification is a crucial task performed by ISP administrators to evaluate and improve network service quality. Deep Packet Inspection (DPI) is a well-known technique used to identify networked traffic. DPI relies mostly on Regular Expressions (REs) evaluated by Finite Automata. Many previous studies have investigated the impacts on the classification accuracy of such systems when inspecting only a portion of the traffic. However, none have discussed the real impacts on the overall system throughput. This work presents a novel technique to perform DPI on Graphics Processing Units (GPU) called Flow-Based Traffic Identification (FBTI) and a proof-of-concept prototype analysis. Basically we want to increase DPI systems? performance on commodity platforms as well as their capacity to identify networked traffic on high speed links. By combining Deterministic Finite Automaton (DFA) for evaluating REs and flow-level packet sampling we achieve a raw performance of over 60 Gbps on GPUs. Our prototype solution could reach a real throughput of over 12 Gbps, measured as the identified volume of flows.

A look under the hood: Revealing performance issues in the DPI engine

Compressed Deterministic Finite Automata (DFA) promises same representation power as traditional DFAs while using less memory for representing Regular Expressions (RE). Experimental evaluations of DFA-based Deep Packet Inspection (DPI) systems focus mainly on memory consumption without observing other important related aspects, such as the matching speed. Proper design of DPI systems requires the assessment of several performance metrics at hardware level, in order to make sure that its implementation will not compromise the overall performance. This paper proposes a novel and systematic evaluation of DPIs and reveals the impact of DFAs data-structures and the correspondent memory layout implementation to hardware-level metrics. Experimental results show that some DFA model and memory layout combinations are almost 100 times faster than others. Results also show that choosing the incorrect model-layout pair can lead to significant performance issues. Our methodology and results will certainly help researchers and developers to design efficient DPI engines, through the selection of the best DFA model and memory layout combination to achieve the targeted overall performance.