kaz29Вестник Казахстанско-Британского технического университетаHerald of the Kazakh-British Technical University1998-66882959-8109Казахстанско-Британский Технический Университетkaz29-257Research ArticleФИЗИКО-МАТЕМАТИЧЕСКИЕ И ТЕХНИЧЕСКИЕ НАУКИPHYSICAL, MATHEMATICAL AND TECHNICAL SCIENCESМЕТОДЫ И ИНСТРУМЕНТЫ ДЛЯ КЛАССИФИКАЦИИ СЕТЕВОГО ТРАФИКАMETHODS AND TOOLS FOR NETWORK TRAFFIC CLASSIFICATIONАбсаттарД. К.AbsattarD.

магистрант, Казахстанско-Британский технический

университет

Kazakh-British Technical UniversityKazakhstan202013112021174111118Copyright © Абсаттар Д.К., 20212021Абсаттар Д.К.Absattar D.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.kbtu.edu.kz/jour/article/view/257

Со времени первых выпусков моделей взаимодействия между конечными устройствами, таких как кольцевая топология, вся картина современной сетевой инфраструктуры изменилась до неузнаваемости. Современные сетевые системы состоят из множества сложных промежуточных модулей, таких как коммутаторы, маршрутизаторы, брандмауэры, концентраторы и т.д. И главная цель этих изобретений заключалась в том, чтобы обеспечить более надежную и масштабируемую основу для связи (качество обслуживания). Тем временем, стремительный рост трафика в интернете заставил сетевых инженеров и инженеров по надежности программного обеспечения уделять больше внимания оптимизации потока данных с обеих сторон, разрабатывая как сетевое программное обеспечение, так и сеть, ориентированную для прикладных программ. Для применения эффективных решений этих задач инженерам необходимо исследовать специфику текущего состояния сети. Чем больше развивается вся система, тем больше данных о сетевом трафике мы получаем, и теперь это помогает нам производить оптимизацию и настройку промежуточных устройств, а не просто масштабировать их с помощью большего количества голого оборудования. Какие протоколы используются чаще всего? Какие типы приложений больше всего загружают пропускную способность сети и так далее. Классификация пакетов может помочь решить ответы, и для этого существуют различные подходы. В этом исследовании я попытался изучить уже известные инструменты и методы, которые могут быть применены для решения подобных задач.

Since the first releases of intercommunication models between end-devices, like ring topology, the whole picture of now days network infrastructure was changed unrecognizably. Modern systems of networking consist of many complex intermediate modules like switches, routers, firewalls, hubs etc. and the main goal of these inventions was to provide more reliable and scalable ground for communication (Quality of Service). Meanwhile, rapid growth of traffic on the Internet forced network engineers and software reliability engineers to pay more attention on the optimization of data flow from both sides, developing network-oriented software and application-oriented network. To apply effective solutions on these tasks, engineers need to research specifics of the current network state. The more whole system evolves, more data about network traffic we gain, and now it helps us to make optimization and tuning of intermediate devices, rather than just scaling it up with more bare hardware. Which protocols are used the most? What types of applications loads the network bandwidth the most? and etc. Classification of packets can help resolve the answers, and there are different approaches to achieve this. In this study, I tried to explore already known tools and methods that can be applied to solve such tasks.

идентификация приложенийхарактеристика трафикарасширенное сетевое управлениесверхточные нейронные сетиклассификация траффика в сетиapplication identificationtraffic characterizationadvanced network managementconvolutional Neural Networksnetwork traffic classificationReferenceshttps://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers. xhtmlhttps://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers. xhtmlMcGarty, Terrence. (2002). The Internet Protocol (IP) and Global Telecommunications Transformation.McGarty, Terrence. (2002). The Internet Protocol (IP) and Global Telecommunications Transformation.M.Mellia, A. Pescapè, L. Salgarelli. Traffic classification and its applications to modern networks. Elsevier Computer Networks, Dec. 2008M.Mellia, A. Pescapè, L. Salgarelli. Traffic classification and its applications to modern networks. Elsevier Computer Networks, Dec. 2008T. Farah, L. Trajkovic. Anonym: A tool for anonymization of the Internet traffic. In IEEE 2013 International Conference on Cybernetics (CYBCONF), 2013, pp. 261-266.T. Farah, L. Trajkovic. Anonym: A tool for anonymization of the Internet traffic. In IEEE 2013 International Conference on Cybernetics (CYBCONF), 2013, pp. 261-266.Cascarano N, Ciminiera L, Risso F. Optimizing deep packet inspection for high-speed traffic analysis. Network System Manager. 2011 19(1), pp. 7-31.Cascarano N, Ciminiera L, Risso F. Optimizing deep packet inspection for high-speed traffic analysis. Network System Manager. 2011 19(1), pp. 7-31.S. Kumar and P. Crowley. Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection. In Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communications (SIGCOMM '06), 2006, New York, USA, pp. 339-350.S. Kumar and P. Crowley. Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection. In Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communications (SIGCOMM '06), 2006, New York, USA, pp. 339-350.D. Ficara, S. Giordano, G. Procissi, F.Vitucci, G.Antichi, A. Di Pietro. An Improved DFA for Fast Regular Expression Matching. SIGCOMM Comput. Commun. Rev. 38, 5 (September 2008), pp. 29-40.D. Ficara, S. Giordano, G. Procissi, F.Vitucci, G.Antichi, A. Di Pietro. An Improved DFA for Fast Regular Expression Matching. SIGCOMM Comput. Commun. Rev. 38, 5 (September 2008), pp. 29-40.F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection. In Proceedings of the ACM/IEEE symposium on Architecture for networking and communications systems (ANCS '06). 2006, New York, USA, pp. 93-102.F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection. In Proceedings of the ACM/IEEE symposium on Architecture for networking and communications systems (ANCS '06). 2006, New York, USA, pp. 93-102.S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese. Curing Regular Expressions Matching Algorithms From Insomnia. In Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems (ANCS '07). 2007,New York, USA, pp. 155-164S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese. Curing Regular Expressions Matching Algorithms From Insomnia. In Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems (ANCS '07). 2007,New York, USA, pp. 155-164R. Smith, C. Estan, S. Jha, and S. Kong. Deflating the Big Bang: Fast and Scalable Deep Packet Inspection with Extended Finite Automata. In Proceedings of the ACM SIGCOMM conference on Data communication (SIGCOMM '08). 2008, New York, USA, pp. 207-218.R. Smith, C. Estan, S. Jha, and S. Kong. Deflating the Big Bang: Fast and Scalable Deep Packet Inspection with Extended Finite Automata. In Proceedings of the ACM SIGCOMM conference on Data communication (SIGCOMM '08). 2008, New York, USA, pp. 207-218.El-Maghraby, Reham & Mostafa, Nada & Bahaa-Eldin, Ayman. (2017). A survey on deep packet inspection. 188-197. 10.1109/ICCES.2017.8275301.El-Maghraby, Reham & Mostafa, Nada & Bahaa-Eldin, Ayman. (2017). A survey on deep packet inspection. 188-197. 10.1109/ICCES.2017.8275301.P. Gupta and N.McKeown, Algorithms for packet classification, IEEE Network Magazine. vol.15, no.2, pp. 24-32, 2001.P. Gupta and N.McKeown, Algorithms for packet classification, IEEE Network Magazine. vol.15, no.2, pp. 24-32, 2001.M.L. Bailey, B. Gopal, M.A. Pagels, L.L. Peterson, and P. Sarkar, PathFinder: A pattern- based packet classifier, Proceedings of the First Symposium on Operating Systems Design and Implementation, pp. 115- 123, 1994.M.L. Bailey, B. Gopal, M.A. Pagels, L.L. Peterson, and P. Sarkar, PathFinder: A pattern- based packet classifier, Proceedings of the First Symposium on Operating Systems Design and Implementation, pp. 115- 123, 1994.Moore AW, Papagiannaki K (2005) Toward the accurate identification of network applications. In: PAM, Springer, vol 5, pp 41–54Moore AW, Papagiannaki K (2005) Toward the accurate identification of network applications. In: PAM, Springer, vol 5, pp 41–54Madhukar A, Williamson C (2006) A longitudinal study of p2p traffic classification. In: Modeling, Analysis, and Simulation of Computer and Telecommuni- cation Systems, 2006. MASCOTS 2006. 14th IEEE International Symposium on, IEEE, pp 179–188Madhukar A, Williamson C (2006) A longitudinal study of p2p traffic classification. In: Modeling, Analysis, and Simulation of Computer and Telecommuni- cation Systems, 2006. MASCOTS 2006. 14th IEEE International Symposium on, IEEE, pp 179–188Hullár, Béla & Laki, Sandor & György, András & Vattay, Gábor. (2010). New Methods in the Payload Based Network Traffic Classification.Hullár, Béla & Laki, Sandor & György, András & Vattay, Gábor. (2010). New Methods in the Payload Based Network Traffic Classification.V. Paxson Empirically derived analytic models of wide-area TCP connections, IEEE/ACM Trans. Netw., vol.2, no.4, pp. 316-336,1994.V. Paxson Empirically derived analytic models of wide-area TCP connections, IEEE/ACM Trans. Netw., vol.2, no.4, pp. 316-336,1994.V. Paxson and S. Floyd Wide area traffic: the failure of Poisson modeling, IEEE/ACM Trans. Netw., vol.3, no.3, pp. 226-244, 1995.V. Paxson and S. Floyd Wide area traffic: the failure of Poisson modeling, IEEE/ACM Trans. Netw., vol.3, no.3, pp. 226-244, 1995.J. Nilsson Introduction to Machine Learning http://robotics.stanford.edu/people/nilsson/MLDraftBook/MLBOOK.pdfJ. Nilsson Introduction to Machine Learning http://robotics.stanford.edu/people/nilsson/MLDraftBook/MLBOOK.pdfAlshammari R, Zincir-Heywood AN (2011) Can encrypted traffic be identified without port numbers, ip addresses and payload inspection? Computer networks 55(6):1326–1350Alshammari R, Zincir-Heywood AN (2011) Can encrypted traffic be identified without port numbers, ip addresses and payload inspection? Computer networks 55(6):1326–1350Auld T, Moore AW, Gull SF (2007) Bayesian neural networks for internet traffic classification. IEEE Transactions on neural networksAuld T, Moore AW, Gull SF (2007) Bayesian neural networks for internet traffic classification. IEEE Transactions on neural networksBagui S, Fang X, Kalaimannan E, Bagui SC, Sheehan J (2017) Comparison of machine-learning algorithms for classification of vpn network traffic flow using time-related features. Journal of Cyber Security TechnologyBagui S, Fang X, Kalaimannan E, Bagui SC, Sheehan J (2017) Comparison of machine-learning algorithms for classification of vpn network traffic flow using time-related features. Journal of Cyber Security TechnologyBengio Y (2009) Learning deep architectures for AI. Found Trends of Machine LearningBengio Y (2009) Learning deep architectures for AI. Found Trends of Machine LearningCrotti M, Dusi M, Gringoli F, Salgarelli L (2007) Traffic classification through simple statistical fingerprinting. ACM SIGCOMM Computer Communication ReviewCrotti M, Dusi M, Gringoli F, Salgarelli L (2007) Traffic classification through simple statistical fingerprinting. ACM SIGCOMM Computer Communication Review

The authors declare that there are no conflicts of interest present.