Characterizing Network Services through Cluster-Set Variations
A Bartoletti, N Tang · 2005
Common Internet services can be reliably distinguished based solely upon the locations of clusters in traffic-based features (ratios of inbound to outbound packets, ratios of packets to payloads, etc.) This capability has value in revealing the nature of ''hidden'' (tunneled) services and in detecting anomalous changes to known services. We provide measures of session capture volumes sufficient to make confidence-level assertions regarding ''unknown'' services, and outline a throughput system for providing alarms for service anomalies.