Network traffic classification by program synthesis
International Conference on Tools and Algorithms for the Construction and …, 2021•Springer
Writing classification rules to identify interesting network traffic is a time-consuming and error-
prone task. Learning-based classification systems automatically extract such rules from
positive and negative traffic examples. However, due to limitations in the representation of
network traffic and the learning strategy, these systems lack both expressiveness to cover a
range of applications and interpretability in fully describing the traffic's structure at the
session layer. This paper presents Sharingan system, which uses program synthesis …
prone task. Learning-based classification systems automatically extract such rules from
positive and negative traffic examples. However, due to limitations in the representation of
network traffic and the learning strategy, these systems lack both expressiveness to cover a
range of applications and interpretability in fully describing the traffic's structure at the
session layer. This paper presents Sharingan system, which uses program synthesis …
Abstract
Writing classification rules to identify interesting network traffic is a time-consuming and error-prone task. Learning-based classification systems automatically extract such rules from positive and negative traffic examples. However, due to limitations in the representation of network traffic and the learning strategy, these systems lack both expressiveness to cover a range of applications and interpretability in fully describing the traffic’s structure at the session layer. This paper presents Sharingan system, which uses program synthesis techniques to generate network classification programs at the session layer. Sharingan accepts raw network traces as inputs and reports potential patterns of the target traffic in NetQRE, a domain specific language designed for specifying session-layer quantitative properties. We develop a range of novel optimizations that reduce the synthesis time for large and complex tasks to a matter of minutes. Our experiments show that Sharingan is able to correctly identify patterns from a diverse set of network traces and generates explainable outputs, while achieving accuracy comparable to state-of-the-art learning-based systems.
Springer
Showing the best result for this search. See all results