Using internet traffic data for predicting network services

The proliferation of WWW has stimulated the development and adoption of many network services. Typically, a server installs a network service on a standard and well-known port. However, many services, including illegitimate FTP servers, backdoors and stepping stones, are installed on non-standard ports. Thus, it becomes extremely difficult to identify the type of a network service by looking at the port(s) the service uses. Conceivably, the identification of types of network services would facilitate network administrators oversee network usage as well as detect and resolve abnormal and malicious activities occurring in the network. In this study, we propose the use of a classification analysis technique (specifically, C4.5) for classifying types of network services, based on the Netflow network traffic data. Empirical evaluation results show that the proposed technique could reach a satisfactory predictive accuracy.