Classifying Network Protocols: A ‘2 Way’ Flow Approach

The identification and classification of network traffic and protocols is a vital step in many quality of service and security systems. Traffic classification strategies must evolve, alongside the protocols utilising the Internet, to overcome the use of ephemeral or masquerading port numbers and transport layer encryption. This research expands the concept of using machine learning on the initial statistics of flow of packets to determine its underlying protocol. Recognising the need for efficient training/retraining of a classifier and the requirement for fast classification, the authors investigate a new application of k-means clustering referred to as 'two-way' classification. The 'two-way' classification uniquely analyses a bidirectional flow as two unidirectional flows and is shown, through experiments on real network traffic, to improve classification accuracy by as much as 18% when measured against similar proposals. It achieves this accuracy while generating fewer clusters, that is, fewer comparisons are needed to classify a flow. A 'two-way' classification offers a new way to improve accuracy and efficiency of machine learning statistical classifiers while still maintaining the fast training times associated with the k-means.

Internet of Things. A proposed secured network topology

The myriad of technologies and protocols working at different layers pose significant security challenges in the upcoming Internet of Things (IoT) paradigm. Security features and needs vary from application to application and it is layer specific. In addition, security has to consider the constraints imposed by energy limited sensor nodes and consider the specific target application in order to provide security at different layers. This paper analyses current standardization efforts and protocols. It proposes a generic secured network topology for IoT and describes the relevant security challenges. Some exploitation examples are also provided.