Research On Traffic Identification Of Instant Messaging Appliactions

With the development and popularization of Internet, applications based on the Internet are increasing drastically. Application identification of Internet traffic is of great importance for network administration and service. Instant Messaging(IM) tool has become one of the important internet applications, which ueses proprietary protocol standard and encryption. While brings convenient to the people, the IM has also brought the difficulty of network administration and a lot of security risks.Traditional techniques for Internet traffic identification can be divided into three kinds: port-based technique, signature-based technique and statistic-based technique. And among them signature-based technique is the most commonly used one because of its robustness and accuracy. However, since manually generating signatures is time consuming and resource intensive, traditional techniques can hardly catch up their increase numbers and the version update. Hence, IM traffic identification has long been a key research topic.Firstly, in this paper, by applying the algorithms of mining association rules and divisive hierarchical clustering in data mining into signature-based application identification technique, a system that extracts IM traffic signature automatically is constructed.Secondly, ordered signature sequences in both flow-level and packet-level are also introduced to enhance the accuracy of the automatic signature extraction.Finally, the system is deployed to extract and analyze the signatures of some popular IM applications. Signature extraction results are compared against those extracted using traditional method. The extracted signatures are employed to identify applications from trace samples and identification results are statistically studied. The results show that our system has achieved the goal of extracting accurate signatures of internet traffic automatically.