Characterizing Network Services through Cluster-Set Variations

Bartoletti, A ; Tang, N

Lawrence Livermore National Laboratory

关键词: Security;    Data Transmission;    Internet;    99 General And Miscellaneous//Mathematics, Computing, And Information Science;   

DOI  :  10.2172/15016408
RP-ID  :  UCRL-TR-211020
RP-ID  :  W-7405-ENG-48
RP-ID  :  15016408

美国|英语

来源: UNT Digital Library

【 摘 要 】

Common Internet services can be reliably distinguished based solely upon the locations of clusters in traffic-based features (ratios of inbound to outbound packets, ratios of packets to payloads, etc.) This capability has value in revealing the nature of ''hidden'' (tunneled) services and in detecting anomalous changes to known services. We provide measures of session capture volumes sufficient to make confidence-level assertions regarding ''unknown'' services, and outline a throughput system for providing alarms for service anomalies.