Probabilistic Identification for Hard to Classify Protocol (Best Paper Award)
Posted on : 20-05-2008 | By : Elie Bursztein | In : Article, Publications
0
Published at WISTP 2008 and Awarded Best Paper
With the growing use of protocols obfuscation techniques, protocol identification for Q.O.S enforcement, traffic prohibition, and intrusion detection has became complex task. This paper address this issue with a probabilistic identification analysis that combines multiples advanced identification techniques and returns an ordered list of probable protocols. It combines a payload analysis with a classifier based on several discriminators, including packet entropy and size.
We show with its implementation, that it overcomes the limitations of traditional port-based protocol identification when dealing with hard to classify protocol such as peer to peer protocols. We also details how it deals with tunneled session and covert channel.
