Classifying Application Flows and Intrusion Detection in Internet Traffic
type: Dataset
contact point: Organization
  fn: CCSD
keyword: encryption
keyword: theses
keyword: securite
keyword: chiffrement
keyword: infoinfo-ohcomputer-science-csother-csoh
keyword: security
keyword: ddos-et-scan-de-port
keyword: infoeu-reposemanticsdoctoralthesis
keyword: sampling
keyword: intrusion-detection
keyword: echantillonnage
keyword: network-traffic-classification
keyword: detection-dintrusion
keyword: ddos-and-portscan
keyword: la-classification-du-trafic-reseau
landing page: https://theses.hal.science/tel-00858571
description: The subject of traffic classification is of great importance for effective networkplanning, policy-based traffic management, application prioritization, and securitycontrol. Although it has received substantial attention in the research communitythere are still many unresolved issues, for example how to classify encrypted trafficflows. This thesis is composed of four parts. The first part presents some theoreticalaspects related to traffic classification and intrusion detection, while in the followingthree parts we tackle specific classification problems and propose accurate solutions.In the second part, we propose an accurate sampling scheme for detecting SYNflooding attacks as well as TCP portscan activity. The scheme examines TCPsegments to find at least one of multiple ACK segments coming from the server.The method is simple and scalable, because it achieves a good detection with aFalse Positive Rate close to zero even for very low sampling rates. Our trace-basedsimulations show that the effectiveness of the proposed scheme only relies on thesampling rate regardless of the sampling method.In the third part, we consider the problem of detecting Skype traffic and classi-fying Skype service flows such as voice calls, skypeOut, video conferences, chat, fileupload and download. We propose a classification method for Skype encrypted traf-fic based on the Statistical Protocol IDentification (SPID) that analyzes statisticalvalues of some traffic attributes. We have evaluated our method on a representativedataset to show excellent performance in terms of Precision and Recall.The last part defines a framework based on two complementary methods for clas-sifying application flows encrypted with TLS/SSL. The first one models TLS/SSLsession states as a first-order homogeneous Markov chain. The parameters of theMarkov models for each considered application differ a lot, which is the basis foraccurate discrimination between applications. The second classifier considers thedevia…
identifier: NNT: 2012GRENM087
issued: 2026-05-09T20:52:49.067470
language: fr
modified: 2026-05-09T20:52:49.067475

test_moissonnage_selune
type: Agent

Classifying Application Flows and Intrusion Detection in Internet Traffic
type: Distribution
access URL: https://theses.hal.science/tel-00858571
format: HTML
issued: 2026-05-09T20:52:49.078333
modified: 2026-05-09T20:52:49.051227