Network traffic classification finds its applications in a variety of network management tasks such as quality of service, security monitoring, traffic engineering, etc. Deep Packet Inspection is one of the methods to identify applications. With the number of proprietary protocols on the rise and network protocols using bit level information for encoding, recently it has been shown that bit level signatures are effective for identifying applications. In this paper, we propose BitProb which generates probabilistic bit signatures for traffic classification. It uses the probability of a bit at a particular position being either 0 or 1 and generates a space efficient signature represented as a state transition machine. Subsequently, it uses the overall probability of an ${n}$ bit binary string extracted from a network flow to identify which application generated the flow. We experiment with three datasets covering twenty protocols (text, binary and proprietary) and show that BitProb classifies network flows with high accuracy and has a minimum number of misclassifications.

中文翻译：

---

BitProb：用于准确应用程序识别的概率位签名

网络流量分类可应用于各种网络管理任务，例如服务质量、安全监控、流量工程等。深度包检测是识别应用程序的方法之一。随着专有协议数量的增加以及使用比特级信息进行编码的网络协议，最近已经表明比特级签名对于识别应用程序是有效的。在本文中，我们提出了 BitProb，它为流量分类生成概率位签名。它使用特定位置的位为 0 或 1 的概率并生成表示为状态转换机的空间高效签名。随后，它使用从网络流中提取的 ${n}$ 位二进制字符串的总体概率来识别哪个应用程序生成了该流。我们对涵盖 20 种协议（文本、二进制和专有）的三个数据集进行了实验，结果表明 BitProb 可以高精度地对网络流进行分类，并且错误分类的数量最少。