Abstract
Internet can be seen as an ever-changing platform where new types of services and applications are constantly emerging. Consequently, novel communications paradigms are continuously appearing, generating traffic with different network requirements. Besides, the emergence of highly stealth attacks leads to an increasing need of accurately profiling Internet services, by mapping their traffic to the originating application, in order to improve network management tasks such as resources optimization, network performance, service personalization and security. However, building such profiles is a highly complex task due to the inherent complexity of network protocols and to the multiple restrictions that prevent or limit the analysis of the generated traffic. Therefore, novel traffic identification methodologies are needed to provide accurate traffic classification and user profiling. In this work, we review some the most relevant traffic classification methodologies that have been published so far, including some recent patents. Then, the paper proposes new classification methodologies that, by analyzing the dynamics of captured Internet traffic, can accurately discriminate the different frequency components generated by diverse licit and illicit Internet applications. In this way, different signatures can be built for each application class, enabling its accurate classification whether if belongs to licit applications or to stealth Internet threats.
Keywords: Traffic Classification, Traffic Profiling, Multi-Scale Decomposition, Internet Attacks.
8