Periodic sequence in netflow recognizing algorithm

Abstract

Periodic sequence is used to complete the auxiliary work of applications. It is generally insensitive to the business logic, it is used to detect the existence of a network connection, or check for patches or updates. The existing products can only recognize periodic sequences with pre-defined static features. To improve the ability of recognizing periodic sequences, we develop a general algorithm based on timing characteristics, packet size, and properties of related network and application protocols. This paper presents a novel periodic sequence recognition technique that overcomes some of the limitations of existing approaches. The technique, combined with fuzzy theory, separates the network packets into sequences, extracts the signature of each sequence, and then recognizes the periodic sequences in the separated sequences. Through the assessment of network applications, the periodic sequences can be exactly recognized from the network packets, which produced by the network applications themselves.