Improvement of application-level analysis of HTTP traffic through server-client correlation

In recent, the diversity and scale of network traffic has been expanding by the increase in various services and applications. Studies of application-level traffic analysis have been performed as the first step of the management and control of network traffic. Many studies have been utilizing “User-Agent” field in the HTTP header in order to analyze application-level HTTP traffic. As a result, most of HTTP-based applications can be classified with user-agent information, but some of HTTP traffic cannot be analyzed since it does not include user-agent field. In this paper, we use server-client correlation of HTTP service in order to improve completeness of HTTP analysis. Therefore, even though user-agent field does not exist in the HTTP header, analysis of application-level can be accomplished. We show our method feasibility through the experiment in a campus network.