The document discusses a method for network traffic classification using packet length signatures to enhance security and user experience. It details data collection, feature engineering, and presents statistics on unique packet lengths across various protocols like VoIP, FTP, and web browsing. The document also outlines future expansions, including the use of the LZW compression algorithm and programming for ASIC integration.

1. 11
Network Traffic Classification by Packet Length
Signature Extraction
Srinidhi H, Tamil Esai Somu, Madhusoodhana Chari S

2. Network Visibility
Dynamic Policy Enforcement
Enhanced Security
Traffic Classification
2
Introduction
Enhanced user
experience!!

3. Traffic Classification
3
Method
Data Collection
Feature Engineering
Classification

4. Packet Length Pattern and its Predictability
4
0
500
1000
1500
2000
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
VOIP
0
200
400
600
800
1000
1200
1400
1600
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
BROWSING
0
500
1000
1500
2000
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
FTP forward

5. FEATURE ENGINEERING
5
Our Solution
 Number of unique packet
lengths
 Statistics of Run Length
Type
Run Length Statistics
No. of
Unique
Packet
Length
Mean Std.
Deviation
Min Max
VOIP 3.26 3.49 1 11 5
FTP 4.75 5.58 1 22 3
Browsing 1.43 1.08 1 7 14

6. Classification and its Interpretability
6
Tree1: Generated with only packet length
statistics.
Tree2 : Generated with no. of unique packet
length, packet length and run length statistics

7. Future Expansions
7
 Expanding signature extraction methods –
LZW compression algorithm
 Programming the ASIC

8. 8