Towards automatic identification of network applications

Traditional application identification based on port numbers has become increasingly inaccurate. A more accurate alternative is to inspect the application payloads of traffic flows. The main drawback of such method is that target applications must be manually analyzed beforehand. Another alternative is to exploit the distinctive statistical properties of traffic flows and apply machine learning techniques to classify or cluster flows. In this paper, we propose a fully automatic mechanism for application identification. The mechanism combine flow clustering based on statistical features in order to generate clusters dominated by a single application on the one hand, and automatic of application signature based on payload contents solely on the other hand. Preliminary results of evaluation using real-world traffic traces indicate that the proposed approach is feasible and promising.