Heuristics to Classify Internet Backbone Traffic based on Connection Patterns
Paper i proceeding, 2008

In this paper Internet backbone traffic is classified on transport layer according to network applications. Classification is done by a set of heuristics inspired by two previous articles and refined in order to better reflect a rough and highly aggregated backbone environment. Obvious misclassified flows by the existing two approaches are revealed and updated heuristics are presented, excluding the revealed false positives, but including missed P2P streams. The proposed set of heuristics is intended to provide researchers and network operators with a relatively simple and fast method to get insight into the type of data carried by their links. A complete application classification can be provided even for short ’snapshot’ traces, including identification of attack and malicious traffic. The usefulness of the heuristics is finally shown on a large dataset of backbone traffic, where in the best case only 0.2% of the data is left unclassified.

Traffic Classification

Traffic Analysis

nternet Measurement


Wolfgang John

Chalmers, Data- och informationsteknik, Datorteknik

Sven Tafvelin

Chalmers, Data- och informationsteknik, Datorteknik

ICOIN '08: Proceedings of the 22nd International Conference on Information Networking

1976-7684 (ISSN)