A temporal-aware signature extraction method using sliding-window mechanism for scalable, cost-effective and accurate traffic classification

摘要: Payload-based traffic classification use a subset of highly correlated payload bytes as signature to identify unlabeled classes. However, these correlations diminish over time due application behavioural changes, resulting in lower true positive subsequent classifications. The short time-to-live signatures means that can become outdated quickly, and new set are needed preserve accuracy. Extracting is computational expensive not scalable continuous changes. This paper proposed lightweight automatic extraction method adaptively recalibrate the sets reflect transitions using sliding-window mechanism. algorithm Leviathan Distance detect optimal number (K) uniquely discriminate Sliding-k then shrink or expand k value base address for temporal changes instead rebuilding completely. experimental results showed sliding-k effective reducing length while preserving accuracy classification.