Network traffic signature generation mechanism using principal component analysis

The Deep Packet Inspection (DPI) method is a popular method that can accurately identify the flow data and its corresponding application. Currently, the DPI method is widely used in common network management systems. However, the major limitation of DPI systems is that their signature library is mainly extracted manually, which makes it hard to efficiently obtain the signature of new applications. Hence, in this paper, we propose an automatic signature extraction mechanism using Principal Component Analysis (PCA) technology, which is able to extract the signature automatically. In the proposed method, the signatures are expressed in the form of serial consistent sequences constructed by principal components instead of normally separated substrings in the original data extracted from the traditional methods. Extensive experiments based on numerous sets of data have been carried out to evaluate the performance of the proposed scheme, and the results prove that the newly proposed method can achieve good performance in terms of accuracy and efficiency.