Detecting Internet Applications using Neural Networks

Recent years have witnessed a huge increase in the number and variety of applications running over IP networks. An accurate mapping of traffic to applications is important for a broad range of network management and measurement tasks including traffic engineering, service differentiation, performance/failure monitoring, and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. Other proposed identification approaches are based on the analysis and interpretation of the packet contents, but they have important drawbacks related to their high processing requirements and their inability to deal with confidentiality requirements. This paper presents a new approach, based on neural networks, that is able to solve the problem of application detection and at the same time can predict the traffic level associated with each application based on the overall aggregated traffic, while overcoming the limitations of the previous approaches