An Improved PrefixSpan-Based Signatures Mining Algorithm with Offset Constraint

The approach based on payload signatures presents more accurately than that using port number and machine learning algorithms in network traffic identification. The performance of payload-based approach heavily depends on abundant and real-time signatures database. Existing approaches to payload signatures identification involved a manual process which is time-consulting and complicated. In this paper, an improved payload signatures mining algorithm based on PrefixSpan is proposed to automatically extract signatures from special network application traffic. Offset constraint in mining process significantly reduces the size of final signatures database and accelerates extracting process. Moreover, patterns matching algorithm can use offset information to discover signatures in network traffic efficiently.