An application-level features mining algorithm based on PrefixSpan

• Published in: 2010 2nd International Conference on Computer Engineering and Technology Vol. 4; pp. V4-461 - V4-465
• Main Authors: Guanzhou Lin, Yang Xin, Yixian Yang, Yong Ji
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.04.2010
• Subjects: Application-level Feature; Error analysis; Information security; Laboratories; Network Traffic Identification; Payloads; PrefixSpan; Protocols; Sequential Pattern Mining; Systems engineering and theory; Telecommunication switching; Telecommunication traffic; Traffic control
• ISBN: 9781424463473; 1424463475
• DOI: 10.1109/ICCET.2010.5485474

Through matching the content of payload against common signatures found in the target application traffic, the approach based on application-level features is widely used in network traffic identification devices. Existing approaches to application feature identification involved a manual process which is time-consulting and complicated. In this paper, a novel application-level features mining algorithm based on PrefixSpan is proposed used to automatically extract features from network traffic. The algorithm mines the complete set of continuous patterns but greatly reduces the efforts of candidate subsequence generation. The experimental results show high precision and low error rate using these mined features in network traffic identification, and the algorithm outperforms the Apriori-based features mining algorithm.