Transaction based network application signatures for text based protocols

1. A method for profiling network traffic of a network, comprising:

identifying, by a processor of a computer system, a training set from a plurality of network flows obtained from the network traffic, wherein the training set is associated with a network application, wherein each network flow comprises a sequence of captured payloads exchanged between a server and a client of the network;

extracting, by the processor, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a portion of the sequence of captured payloads;

analyzing, by the processor, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells;

generating, by the processor, a signature of the network application using the similarity measure; and

classifying, by the processor and based on the signature of the network application, a new network flow, separate from the plurality of network flows, as being generated by the network application.

2. The method of claim 1 , wherein the network application comprises a layer-seven application.

3. The method of claim 1 , further comprising:

dividing the plurality of cells to generate a first uni-directional cell group comprising captured payloads sent from servers of the network and a second uni-directional cell group comprising captured payloads sent from clients of the network,

wherein the signature of the network application is generated from one of the first uni-directional cell group and the second uni-directional cell group.

4. The method of claim 1 , further comprising:

extracting a set of signature terms from the plurality of cells, wherein the set of signature terms are selected from a plurality of substrings extracted from captured payloads of the plurality of cells;

representing a portion of the captured payloads of the plurality of cells as a plurality of regular expressions, each comprising a sequence of one or more signature terms based on the set of signature terms; and

representing a first regular expression of the plurality of regular expressions as a first path in a term transition state machine (TTSM), the first path comprising a first state and a second state coupled by a first link, wherein the first link is assigned a first signature term in the set of signature terms and a first transition probability associated with the first signature term, wherein the first transition probability represents probability of signature term transitions into the first signature term in the first regular expression,

wherein the signature of the network application comprises the TTSM.

5. The method of claim 4 , further comprising:

representing a second regular expression of the plurality of regular expressions as a second path in the TTSM, the second path comprising the first state and a third state coupled by a second link, wherein the second link is assigned a second signature term in the set of signature terms and a second transition probability associated with the second signature term, wherein the second transition probability represents probability of signature term transitions into the second signature term in the second regular expression,

wherein classifying the new network flow based on the signature of the network application comprises:

comparing the first transition probability and the second transition probability to generate a comparison result; and

traversing the first link in response to the comparison result indicating that the first transition probability exceeds the second transition probability.

6. The method of claim 1 , further comprising:

combining the TTSM and another TTSM generated from the plurality of cells into an overlay state machine; and

expanding signature terms in the TTSM and the another TTSM in the overlay state machine to form a transaction based TTSM.

7. The method of claim 1 , further comprising:

including the signature of the network application in a signature set of the network application;

identifying a portion of the plurality of network flows obtained from the network traffic as failing to be classified based on the signature set of the network application; and

analyzing the portion of the plurality of network flows to identify the training set.

8. A system for profiling network traffic of a network, comprising:

a processor;

memory, the memory including instructions for:

identifying, by a processor of a computer system, a training set from a plurality of network flows obtained from the network traffic, wherein the training set is associated with a network application, wherein each network flow comprises a sequence of captured payloads exchanged between a server and a client of the network;

extracting, by the processor, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a portion of the sequence of captured payloads;

analyzing, by the processor, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells;

generating, by the processor, a signature of the network application using the similarity measure; and

classifying, by the processor and based on the signature of the network application, a new network flow, separate from the plurality of network flows, as being generated by the network application.

9. The system of claim 8 , wherein the network application comprises a layer-seven application.

10. The system of claim 8 , further comprising:

dividing the plurality of cells to generate a first uni-directional cell group comprising captured payloads sent from servers of the network and a second uni-directional cell group comprising captured payloads sent from clients of the network,

wherein the signature of the network application is generated from one of the first uni-directional cell group and the second uni-directional cell group.

11. The system of claim 8 , further comprising:

extracting a set of signature terms from the plurality of cells, wherein the set of signature terms are selected from a plurality of substrings extracted from captured payloads of the plurality of cells;

representing a portion of the captured payloads of the plurality of cells as a plurality of regular expressions, each comprising a sequence of one or more signature terms based on the set of signature terms; and

representing a first regular expression of the plurality of regular expressions as a first path in a term transition state machine (TTSM), the first path comprising a first state and a second state coupled by a first link, wherein the first link is assigned a first signature term in the set of signature terms and a first transition probability associated with the first signature term, wherein the first transition probability represents probability of signature term transitions into the first signature term in the first regular expression,

wherein the signature of the network application comprises the TTSM.

12. The system of claim 11 , further comprising:

representing a second regular expression of the plurality of regular expressions as a second path in the TTSM, the second path comprising the first state and a third state coupled by a second link, wherein the second link is assigned a second signature term in the set of signature terms and a second transition probability associated with the second signature term, wherein the second transition probability represents probability of signature term transitions into the second signature term in the second regular expression,

wherein classifying the new network flow based on the signature of the network application comprises:

comparing the first transition probability and the second transition probability to generate a comparison result; and

traversing the first link in response to the comparison result indicating that the first transition probability exceeds the second transition probability.

13. The system of claim 8 , further comprising:

combining the TTSM and another TTSM generated from the plurality of cells into an overlay state machine; and

expanding signature terms in the TTSM and the another TTSM in the overlay state machine to form a transaction based TTSM.

14. The system of claim 8 , further comprising:

including the signature of the network application in a signature set of the network application;

identifying a portion of the plurality of network flows obtained from the network traffic as failing to be classified based on the signature set of the network application; and

analyzing the portion of the plurality of network flows to identify the training set.

15. A non-transitory computer readable medium embodying instructions for profiling network traffic of a network, the instructions when executed by a processor comprising functionality for:

identifying, by a processor of a computer system, a training set from a plurality of network flows obtained from the network traffic, wherein the training set is associated with a network application, wherein each network flow comprises a sequence of captured payloads exchanged between a server and a client of the network;

extracting, by the processor, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a portion of the sequence of captured payloads;

analyzing, by the processor, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells;

generating, by the processor, a signature of the network application using the similarity measure; and

classifying, by the processor and based on the signature of the network application, a new network flow, separate from the plurality of network flows, as being generated by the network application.

16. The non-transitory computer readable medium of claim 15 , wherein the network application comprises a layer-seven application.

17. The non-transitory computer readable medium of claim 15 , further comprising:

dividing the plurality of cells to generate a first uni-directional cell group comprising captured payloads sent from servers of the network and a second uni-directional cell group comprising captured payloads sent from clients of the network,

wherein the signature of the network application is generated from one of the first uni-directional cell group and the second uni-directional cell group.

18. The non-transitory computer readable medium of claim 15 , further comprising:

extracting a set of signature terms from the plurality of cells, wherein the set of signature terms are selected from a plurality of substrings extracted from captured payloads of the plurality of cells;

representing a portion of the captured payloads of the plurality of cells as a plurality of regular expressions, each comprising a sequence of one or more signature terms based on the set of signature terms; and

representing a first regular expression of the plurality of regular expressions as a first path in a term transition state machine (TTSM), the first path comprising a first state and a second state coupled by a first link, wherein the first link is assigned a first signature term in the set of signature terms and a first transition probability associated with the first signature term, wherein the first transition probability represents probability of signature term transitions into the first signature term in the first regular expression,

wherein the signature of the network application comprises the TTSM.

19. The non-transitory computer readable medium of claim 18 , further comprising:

representing a second regular expression of the plurality of regular expressions as a second path in the TTSM, the second path comprising the first state and a third state coupled by a second link, wherein the second link is assigned a second signature term in the set of signature terms and a second transition probability associated with the second signature term, wherein the second transition probability represents probability of signature term transitions into the second signature term in the second regular expression,

wherein classifying the new network flow based on the signature of the network application comprises:

comparing the first transition probability and the second transition probability to generate a comparison result; and

traversing the first link in response to the comparison result indicating that the first transition probability exceeds the second transition probability.

20. The non-transitory computer readable medium of claim 15 , further comprising:

combining the TTSM and another TTSM generated from the plurality of cells into an overlay state machine; and

expanding signature terms in the TTSM and the another TTSM in the overlay state machine to form a transaction based TTSM.