Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
Source abstract
Abstract
Previous network feature extraction methods used for network anomaly detection have some problems, such as being unable to extract features from the original network traffic, or that they can only extract coarse-grained features, as well as that they are highly dependent on manual analysis. To solve these problems, this paper proposes a fine-grained and highly practical dynamic application fingerprint extraction method. By putting forward a fine-grained high-utility dynamic fingerprinting (Huf) algorithm to build a Huf-Tree based on the N-gram (every substring of a larger string, of a fixed length n) model, combining it with the network traffic segment-IP address transition (IAT) method to achieve dynamic application fingerprint extraction, and through the utility of fingerprint, the calculation was performed to obtain a more valuable fingerprint, to achieve fine-grained and efficient flow characteristic extraction, and to solve the problem of this method being highly dependent on manual analysis. The experimental results show that the Huf algorithm can realize the dynamic application of fingerprint extraction and solve the existing problems.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Internet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection · Network Packet Processing and Optimization
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Automation, Beijing Information Science and Technology University, Beijing 100192, China
Key Laboratory of Modern Measurement and Control Technology, Ministry of Education, Beijing 100192, China
China Information Technology Security Evaluation Center, Beijing 100085, China
Funding
National Key Research and Development Program · Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing
References (30)
Show source-provided references
1. A hybrid intrusion detection system based on ABC-AFS algorithm for misuse and anomaly detection10.1016/j.comnet.2018.02.028 ↗
2. Robust Smartphone App Identification Via Encrypted Network Traffic Analysis10.1109/TIFS.2017.2737970 ↗
3. Xu, Y., Wang, T., Li, Q., Gong, Q., Chen, Y., and Jiang, Y. (2018, January 3–7). A multi-tab website fingerprinting attack. Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, PR, USA.10.1145/3274694.3274697 ↗
4. Dai, S., Tongaonkar, A., Wang, X., Nucci, A., and Song, D. (2013, January 14–19). NetworkProfiler: Towards Automatic Fingerprinting of Android Apps. Proceedings of the INFOCOM, 2013 Proceedings IEEE, Turin, Italy.10.1109/INFCOM.2013.6566868 ↗
5. Khatouni, A.S., and Zincir-Heywood, N. (July, January 29). Integrating Machine Learning with Off-the-Shelf Traffic Flow Features for HTTP/HTTPS Traffic Classification. Proceedings of the 2019 IEEE Symposium on Computers and Communications (ISCC), Barcelona, Spain.10.1109/ISCC47284.2019.8969578 ↗
6. Combating Advanced Persistent Threats: From Network Event Correlation to Incident Detection10.1016/j.cose.2014.09.006 ↗
7. Network traffic fingerprinting based on approximated kernel two-sample test10.1109/TIFS.2017.2768018 ↗
8. Santos, I., Penya, Y.K., Devesa, J., and Bringas, P.G. (2009, January 6–10). N-Grams-based file signatures for mal ware detection. Proceedings of the 11th International Conference on Enterprise Information Systems (ICEIS), Milan, Italy.10.5220/0001863603170320 ↗
9. Traffic Classification Based on Zero-Length Packets10.1109/TNSM.2018.2825881 ↗
10. Learning communication patterns for malware discovery in HTTPs data10.1016/j.eswa.2018.02.010 ↗
11. Muehlstein, J., Zion, Y., Bahumi, M., Kirshenboim, I., Dubin, R., Dvir, A., and Pele, O. (2017, January 8–11). Analyzing HTTPS Encrypted Traffic to Identify User’s Operating System, Browser and Application. Proceedings of the 2017 14th IEEE Annual Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, USA.10.1109/CCNC.2017.8013420 ↗
12. Application traffic classification using payload size sequence signature10.1002/nem.1981 ↗
13. Fast prediction of web user browsing behaviours using most interesting patterns10.1177/0165551516673293 ↗
14. Lu, J., Gou, G., Su, M., Song, D., Liu, C., Yang, C., and Guan, Y. (2021, January 18–22). GAP-WF: Graph Attention Pooling Network for Fine-grained SSL/TLS Website Fingerprinting. Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN), Shenzhen, China.10.1109/IJCNN52387.2021.9533543 ↗
15. Sun, F., Zhao, L., Zhou, B., and Wang, Y. (2020, January 19–21). Automatic Fingerprint Extraction of Mobile APP Users in Network Traffic. Proceedings of the 2020 5th International Conference on Computational Intelligence and Applications (ICCIA), Beijing, China.10.1109/ICCIA49625.2020.00036 ↗
16. A Survey of Correlated High Utility Pattern Mining10.1109/ACCESS.2021.3065393 ↗
17. Bao, J., Zhang, L., and Han, B. (2019, January 17–19). Collaborative Attention Network with Word and N-Gram Sequences Modeling for Sentiment Classification. Proceedings of the International Conference on Artificial Neural Networks, Munich, Germany.10.1007/978-3-030-30490-4_8 ↗
18. Detecting zero-day attacks using context-aware anomaly detection at the application-layer
19. Detecting Android Malware Leveraging Text Semantics of Network Flows10.1109/TIFS.2017.2771228 ↗
20. Korczynski, M., and Duda, A. (May, January 27). Markov Chain Fingerprinting to Classify Encrypted Traffic. Proceedings of the 2014 IEEE Conference on Computer Communications—IEEE INFOCOM 2014, Toronto, ON, Canada.10.1109/INFOCOM.2014.6848005 ↗
21. Unsupervised traffic classification using flow statistical properties and IP packet payload10.1016/j.jcss.2012.11.004 ↗
22. Bhatiaa, A., Bahugunaa, A.A., Tiwaria, K., Haribabua, K., and Vishwakarmab, D. (2020). A Survey on Analyzing Encrypted Network Traffic of Mobile Devices. arXiv.
23. Cong, Y. (November, January 30). Research on Data Association Rules Mining Method Based on Improved Apriori Algorithm. Proceedings of the 2020 International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE), Bangkok, Thailand.10.1109/ICBASE51474.2020.00085 ↗
24. Mining High Utility Sequential Patterns Using Multiple Minimum Utility10.1142/S0218001418590176 ↗
25. EFP-tree: An efficient FP-tree for incremental mining of frequent patterns
26. Erasable pattern mining based on tree structures with damped window over data streams10.1016/j.engappai.2020.103735 ↗
27. Chang, Y.I., Li, C.E., Chou, T.J., and Yen, C.Y. (2018, January 13–17). A weight-order-based lattice algorithm for mining maximal weighted frequent patterns over a data stream sliding window. Proceedings of the 2018 IEEE International Conference on Applied System Invention (ICASI), Chiba, Japan.10.1109/ICASI.2018.8394430 ↗
28. Efficient algorithm for mining high average-utility itemsets in incremental transaction databases10.1007/s10489-016-0890-z ↗
29. Memory-adaptive high utility sequential pattern mining over data streams10.1007/s10994-016-5617-1 ↗
30. High utility fuzzy product mining (HUFPM) using investigation of HUWAS approach10.1007/s12652-021-03231-8 ↗