SigBox: Automatic Signature Generation Method for Fine-grained Traffic Identification

다국어 초록 (Multilingual Abstract)

With the continual appearance of new applications and the frequent update of these applications, the need for automatic signature generation is emphasized. Although several automatic methods have been proposed, there are still limitations to adopt real network environment in terms of automation, robustness, and sophistication. To address this issue, we propose an automatic signature generation method, called SigBox, for fine-grained traffic identification. This system extracts three types of signature such as content, packet, and flow signature using a modified sequence pattern algorithm. The flow signature, final result of this system, consists of a series of packet signatures, and the packet signature consists of a series of content signatures. The content signature means distinguishable and unique substring of packet payload, and consists of a series of characters or hex values. Using the modified sequence pattern algorithm, we can improve system performance in aspect of automation and robustness. Also, the proposed method can generate sophisticated signature for fine-grained traffic identification by using flow-level features beyond ones of packet-level. In order to prove the feasibility of our proposed system, we present experimental results based on ten popular applications after defining three metrics such as redundancy, coverage, and accuracy. Also, we show the quality of signature compared to existing methods.

목차 (Table of Contents)

• ABSTRACT 1
• Figure Index 5
• Table Index 7
• 1 Introduction 9
• 2 Related Work 13
• 2.1 Categories of traffic identification method 13
• 2.1.1 Packet-level identification 13
• 2.1.2 Flow-level identification 15
• 2.1.3 Host-level identification 17
• 2.2 Existing automatic signature generation methods 18
• 2.2.1 Categories of automatic signature generation 18
• 2.2.2 Evaluation of automatic signature generation method 20
• 2.3 Sequence pattern algorithm 28
• 3 SigBox : Automatic Signature Generation Method 30
• 3.1 Signature definition 32
• 3.2 Sequence pattern algorithm for SigBox 37
• 3.3 System architecture 44
• 3.3.1 Content Signature generator 46
• 3.3.2 Packet signature generator 49
• 3.3.3 Flow signature generator 51
• 3.3.4 Signature refiner 53
• 4 Evaluation 55
• 4.1 Traffic trace 55
• 4.2 Signature analysis 59
• 4.2.1 Experiment result 59
• 4.2.2 Evaluation metrics 70
• 4.2.3 Redunancy evaluation 73
• 4.2.4 Coverage evaluation 75
• 4.2.5 Accuracy evaluation 78
• 4.2.6 Comparison of signature types 82
• 4.2.7 Comparison with other methods 90
• 5 Conclutions and Future Works 92
• REFERENCE 94
• ACKNOWLEDGEMENTS 102