bibliography.bib

% This file was created with JabRef 2.10.
% Encoding: UTF8


@Article{Ciflikli-2012-Packet,
  Title                    = {{Packet traffic features of IPv6 and IPv4 protocol traffic}},
  Author                   = {\c{C}iflikli, Cebrail and Gerzer, Ali and {\"{O}z\c{s}ahin}, Abdulah Tuncay},
  Journal                  = {Turkish Journal of Electrical Engineering \& Computer Sciences},
  Year                     = {2012},
  Number                   = {5},
  Pages                    = {727--749},
  Volume                   = {20},

  Doi                      = {10.3906/elk-1008-696},
  Issue_date               = {September 2012},
  Numpages                 = {23},
  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InProceedings{Aazam-2010-Comparison,
  Title                    = {{Comparison of IPv6 Tunneled Traffic of Teredo and ISATAP over Test-bed Setup}},
  Author                   = {Aazam, Mohammad and Khan, Imran and Alam, Muhammad and Qayyum, Amir},
  Booktitle                = {2010 International Conference on Information and Emerging Technologies},
  Year                     = {2010},
  Month                    = jun,
  Pages                    = {1-4},

  Doi                      = {10.1109/ICIET.2010.5625689},
  Keywords                 = {IP networks;Linux;ICMP-ping traffic;IPv6 tunneled traffic comparison;ISATAP;Linux operating systems;MS Windows Server 2003;MS Windows XP;audio streaming;test bed setup;video streaming;Linux;Routing protocols;Servers;Tunneling;IPv6 tunneling;ISATAP;Teredo},
  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InProceedings{Abt-2013-Passive,
  Title                    = {{Passive Remote Source NAT Detection Using Behavior Statistics Derived from Netflow}},
  Author                   = {Abt, Sebastian and Dietz, Christian and Baier, Harald and Petrovi\'{c}, Slobodan},
  Booktitle                = {Proceedings of the 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security: Emerging Management Mechanisms for the Future Internet - Volume 7943},
  Year                     = {2013},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {148--159},
  Publisher                = {Springer-Verlag},
  Series                   = {AIMS'13},

  Acmid                    = {2525047},
  Doi                      = {10.1007/978-3-642-38998-6_18},
  ISBN                     = {978-3-642-38997-9},
  Keywords                 = {C4.5, NAT detection, NetFlow, SVM, network address translation},
  Location                 = {Barcelona, Spain},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2017.05.25},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-38998-6_18}
}

@Article{skype-hunter,
  Title                    = {{Skype-Hunter: A real-time system for the detection and classification of Skype traffic}},
  Author                   = {Adami, Davide and Callegar, Christian and Giordano, Stefano and Pagano, Michele and Pepe, Teresa},
  Journal                  = {International Journal of Communication Systems},
  Year                     = {2011},

  Month                    = Feb,
  Number                   = {3},
  Pages                    = {386--403},
  Volume                   = {25},

  Abstract                 = {In the previous years, Skype has gained more and more popularity, since it is seen as the best VoIP software with good quality of sound, ease of use and one that works everywhere and with every OS. Because of its great diffusion, both the operators and the users are, for different reasons, interested in
detecting Skype traffic.
In this paper we propose a real-time algorithm (named Skype-Hunter) to detect and classify Skype traffic. In more detail, this novel method, by means of both signature-based and statistical procedures, is able to correctly reveal and classify the signaling traffic as well as the data traffic (calls and file transfers). To assess the effectiveness of the algorithm, experimental tests have been performed with several traffic data sets, collected in different network scenarios. Our system outperforms the ‘classical’ statistical traffic classifiers as well as the state-of-the-art ad hoc Skype classifier.},
  Doi                      = {10.1002/dac.1247},
  Keywords                 = {Skype, detection, traffic description},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03},
  Url                      = {http://onlinelibrary.wiley.com/doi/10.1002/dac.1247/pdf}
}

@InProceedings{Akhawe-2013-Heres,
  Title                    = {{Here's My Cert, So Trust Me, Maybe?: Understanding TLS Errors on the Web}},
  Author                   = {Akhawe, Devdatta and Amann, Bernhard and Vallentin, Matthias and Sommer, Robin},
  Booktitle                = {Proceedings of the 22Nd International Conference on World Wide Web},
  Year                     = {2013},

  Address                  = {Republic and Canton of Geneva, Switzerland},
  Pages                    = {59--70},
  Publisher                = {International World Wide Web Conferences Steering Committee},
  Series                   = {WWW '13},

  Abstract                 = {When browsers report TLS errors, they cannot distinguish between attacks and harmless server misconfigurations; hence they leave it to the user to decide whether continuing is safe. However, actual attacks remain rare. As a result, users quickly become used to "false positives" that deplete their attention span, making it unlikely that they will pay sufficient scrutiny when a real attack comes along. Consequently, browser vendors should aim to minimize the number of low-risk warnings they report. To guide that process, we perform a large-scale measurement study of common TLS warnings. Using a set of passive network monitors located at different sites, we identify the prevalence of warnings for a total population of about 300,000 users over a nine-month period. We identify low-risk scenarios that consume a large chunk of the user attention budget and make concrete recommendations to browser vendors that will help maintain user attention in high-risk situations. We study the impact on end users with a data set much larger in scale than the data sets used in previous TLS measurement studies. A key novelty of our approach involves the use of internal browser code instead of generic TLS libraries for analysis, providing more accurate and representative results.},
  Acmid                    = {2488395},
  ISBN                     = {978-1-4503-2035-1},
  Keywords                 = {tls, warnings},
  Location                 = {Rio de Janeiro, Brazil},
  Numpages                 = {12},
  Owner                    = {velan},
  Review                   = {Authors study TLS errors reported by common browsers. They passively monitor certificates of servers contacted by users and evaluate errors encountered during validation. Unlike other works, they use the same TLS library as browsers, which gives different validation results than OpenSSL. Authors provide recommendation for browser authors to reduce number of TLS related error messages.},
  Timestamp                = {2014.06.18},
  Url                      = {http://dl.acm.org/citation.cfm?id=2488388.2488395}
}

@TechReport{Alcock-2012-libprotoident,
  Title                    = {{Libprotoident: Traffic Classification Using Lightweight Packet Inspection}},
  Author                   = {Alcock, Shane and Nelson, Richard},
  Institution              = {WAND Network Research Group},
  Year                     = {2012},

  Abstract                 = {At present, accurate traffic classification usually requires the use of deep packet inspection to analyse packet payload. This requires significant CPU and memory resources and are invasive of network user privacy. In this paper, we propose an alternative traffic classification approach that is lightweight and
 only examines the first four bytes of packet payload observed in each direction. We have implemented as an open-source library called libprotoident, which we evaluate by comparing its performance against existing traffic classifiers that use deep packet inspection. Our results show that our approach offers comparable (if not better) accuracy than tools that have access to full packet payload, yet requires less processing resources and is more acceptable, from a privacy standpoint, to network operators and users.},
  Keywords                 = {libprotoident},
  Owner                    = {velan},
  Timestamp                = {2017.04.28},
  Url                      = {http://www.wand.net.nz/~salcock/lpi/lpi.pdf},
  Urldate                  = {2017-04-28}
}

@Book{Alpaydin-2010-Introduction,
  Title                    = {{Introduction to Machine Learning}},
  Author                   = {Alpaydin, Ethem},
  Publisher                = {The MIT Press},
  Year                     = {2010},
  Edition                  = {2nd},

  Abstract                 = {The goal of machine learning is to program computers to use example data or past experience to solve a given problem. Many successful applications of machine learning exist already, including systems that analyze past sales data to predict customer behavior, optimize robot behavior so that a task can be completed using minimum resources, and extract knowledge from bioinformatics data. Introduction to Machine Learning is a comprehensive textbook on the subject, covering a broad array of topics not usually included in introductory machine learning texts. In order to present a unified treatment of machine learning problems and solutions, it discusses many methods from different fields, including statistics, pattern recognition, neural networks, artificial intelligence, signal processing, control, and data mining. All learning algorithms are explained so that the student can easily move from the equations in the book to a computer program. The text covers such topics as supervised learning, Bayesian decision theory, parametric methods, multivariate methods, multilayer perceptrons, local models, hidden Markov models, assessing and comparing classification algorithms, and reinforcement learning. New to the second edition are chapters on kernel machines, graphical models, and Bayesian estimation; expanded coverage of statistical tests in a chapter on design and analysis of machine learning experiments; case studies available on the Web (with downloadable results for instructors); and many additional exercises. All chapters have been revised and updated. Introduction to Machine Learning can be used by advanced undergraduates and graduate students who have completed courses in computer programming, probability, calculus, and linear algebra. It will also be of interest to engineers in the field who are concerned with the application of machine learning methods. Adaptive Computation and Machine Learning series},
  ISBN                     = {978-0262012430},
  Owner                    = {velan},
  Review                   = {The book contains description of the most common machine learning algorithms, such as RIPPER, Naive Bayesian, C4.5, clustering, Hidden Markov Models and boosting. Index can be found at http://mitpress.mit.edu/sites/default/files/titles/content/9780262012430_ind_0001.pdf},
  Timestamp                = {2014.10.17}
}

@InProceedings{Alshammari-2009-Classifying,
  Title                    = {{Classifying SSH Encrypted Traffic with Minimum Packet Header Features Using Genetic Programming}},
  Author                   = {Alshammari, Riyad and Lichodzijewski, Peter and Heywood, I. Malcolm and Zincir-Heywood, A. Nur},
  Booktitle                = {Proceedings of the 11th Annual Conference Companion on Genetic and Evolutionary Computation Conference: Late Breaking Papers},
  Year                     = {2009},

  Address                  = {New York, NY, USA},
  Pages                    = {2539--2546},
  Publisher                = {ACM},
  Series                   = {GECCO '09},

  Abstract                 = {The classification of Encrypted Traffic, namely Secure Shell (SSH), on the fly from network TCP traffic represents a particularly challenging application domain for machine learning. Solutions should ideally be both simple - therefore efficient to deploy - and accurate. Recent advances to teambased Genetic Programming provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain and increasing the throughput of solutions. Thus, in this work we have investigated the identification of SSH encrypted traffic based on packet header features without using IP addresses, port numbers and payload data. Evaluation of C4.5 and AdaBoost - representing current best practice - against the Symbiotic Bid-based (SBB) paradigm of team-based Genetic Programming (GP) under data sets common and independent from the training condition indicates that SBB based GP solutions are capable of providing simpler solutions without sacrificing accuracy.},
  Acmid                    = {1570358},
  Doi                      = {10.1145/1570256.1570358},
  ISBN                     = {978-1-60558-505-5},
  Keywords                 = {active learning, defense applications, encrypted traffic classification, genetic programming, packet, problem decomposition, security, supervised learning, teaming},
  Location                 = {Montreal, Qu\&\#233;bec, Canada},
  Numpages                 = {8},
  Owner                    = {velan},
  Review                   = {Comparison of AdaBoost and C4.5. Packet header features were selected using genetic programming. Authors used DARPA and custom data sets. SSH is the reference protocol that was identified in the data.},
  Timestamp                = {2014.10.17},
  Url                      = {http://doi.acm.org/10.1145/1570256.1570358}
}

@Article{Alshammari-2011-Can,
  Title                    = {{Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?}},
  Author                   = {Alshammari, Riyad and Zincir-Heywood, A. Nur},
  Journal                  = {Computer Networks },
  Year                     = {2011},
  Number                   = {6},
  Pages                    = {1326 - 1350},
  Volume                   = {55},

  Abstract                 = {Identifying encrypted application traffic represents an important issue for many network tasks including quality of service, firewall enforcement and security. Solutions should ideally be both simple – therefore efficient to deploy – and accurate. This paper presents a machine learning based approach employing simple packet header feature sets and statistical flow feature sets without using the \{IP\} addresses, source/destination ports and payload information to unveil encrypted application tunnels in network traffic. We demonstrate the effectiveness of our approach as a forensic analysis tool on two encrypted applications, Secure \{SHell\} (SSH) and Skype, using traces captured from entirely different networks. Results indicate that it is possible to identify encrypted traffic tunnels with high accuracy without inspecting payload, \{IP\} addresses and port numbers. Moreover, it is also possible to identify which services run in encrypted tunnels.},
  Doi                      = {http://dx.doi.org/10.1016/j.comnet.2010.12.002},
  ISSN                     = {1389-1286},
  Keywords                 = {Encrypted traffic identification},
  Owner                    = {velan},
  Review                   = {Authors present a machine learning based approach to unveil encrypted application tunnels in network traffic. They show how to identify services running in such encrypted tunnels. Three machine learning algorithms are tested: AdaBoost, C4.5 and Genetic Programming. Authors use AMP, MAWI DARPA99 and Italy and custom created traffic traces for training and testing the classifiers. PacketSharper is used to classify the custom traces. Authors work with packet header attributes and flow features separately. They also show that the combination of both allow to improve the detection rate of encrypted traffic. They also discovered that the Genetic Programming approach achieved the best results.},
  Timestamp                = {2014.10.17},
  Url                      = {http://www.sciencedirect.com/science/article/pii/S1389128610003695}
}

@InProceedings{Alshammari-2010-Investigation,
  Title                    = {{An Investigation on the Identification of VoIP traffic: Case study on Gtalk and Skype}},
  Author                   = {Alshammari, Riyad and Zincir-Heywood, A. Nur},
  Booktitle                = {Network and Service Management (CNSM), 2010 International Conference on},
  Year                     = {2010},
  Month                    = Oct,
  Pages                    = {310-313},

  Abstract                 = {The classification of encrypted traffic on the fly from network traces represents a particularly challenging application domain. Recent advances in machine learning provide the opportunity to decompose the original problem into a subset of classifiers with non-overlapping behaviors, in effect providing further insight into the problem domain. Thus, the objective of this work is to classify VoIP encrypted traffic, where Gtalk and Skype applications are taken as good representatives. To this end, three different machine learning based approaches, namely, C4.5, AdaBoost and Genetic Programming (GP), are evaluated under data sets common and independent from the training condition. In this case, flow based features are employed without using the IP addresses, source/destination ports and payload information. Results indicate that C4.5 based machine learning approach has the best performance.},
  Doi                      = {10.1109/CNSM.2010.5691210},
  Keywords                 = {Internet telephony;genetic algorithms;learning (artificial intelligence);telecommunication traffic;AdaBoost;C4.5;Gtalk;IP address;Skype;VoIP encrypted traffic;genetic programming;machine learning;source/destination port;Cryptography;Feature extraction;Internet;Machine learning;Machine learning algorithms;Protocols;Training data},
  Location                 = {Niagara Falls, Canada},
  Owner                    = {velan},
  Review                   = {Authors use supervised machine learning methods: AdaBoost, C4.5 and Genetic Programming to destinguish between Skype, Gtalk and other traffic. Both Skype and Gtalk use encryption, therefore the methods must distinguish between several types of encrypted traffic. The data set contains other VoIP data, both encrypted and unencrypted. Moreover, it contains traces of other applications such as FTP, SSH, HTTP, and mail. Ground truth was established using commercial classification tool using DPI. Ground truth for manually generated traces is easily gained. 22 flow features are used by the classifiers. Experiments showed that the C4.5 classifier achieves the best detection rate with small false positive rate.},
  Timestamp                = {2015.03.23}
}

@InProceedings{Alshammari-2009-Machine,
  Title                    = {{Machine learning based encrypted traffic classification: Identifying SSH and Skype}},
  Author                   = {Alshammari, Riyad and Zincir-Heywood, A. Nur},
  Booktitle                = {Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on},
  Year                     = {2009},
  Month                    = Jul,
  Pages                    = {1-8},

  Abstract                 = {The objective of this work is to assess the robustness of machine learning based traffic classification for classifying encrypted traffic where SSH and Skype are taken as good representatives of encrypted traffic. Here what we mean by robustness is that the classifiers are trained on data from one network but tested on data from an entirely different network. To this end, five learning algorithms - adaboost, support vector machine, Nai¿e Bayesian, RIPPER and C4.5 - are evaluated using flow based features, where IP addresses, source/destination ports and payload information are not employed. Results indicate the C4.5 based approach performs much better than other algorithms on the identification of both SSH and Skype traffic on totally different networks.},
  Doi                      = {10.1109/CISDA.2009.5356534},
  Keywords                 = {cryptography;learning (artificial intelligence);support vector machines;telecommunication traffic;C4.5 based approach;Nai¿e Bayesian;RIPPER;Skype;adaboost;encrypted traffic classification;flow based features;machine learning;secure shell;support vector machine;traffic classification;Bayesian methods;Cryptography;Financial management;Machine learning;Payloads;Robustness;Support vector machine classification;Support vector machines;Telecommunication traffic;Traffic control},
  Location                 = {Ottawa, Canada},
  Owner                    = {velan},
  Review                   = {Authors compare five different machine learning algorithms for traffic classification: AdaBoost, Support Vector Machine, Naive Batesian, RIPPER, C4.5. Skype and SSH protocols are classified without the use of packet payloads, IP addresses of ports. The robustnest of the methods is tested by teaching each method on one network and running on another nework, with different properties. Authors use two public traces (no payload), DARPA99 trace (with payload, SSH identified by handshake) and one trace measured at their university campus (labeled using PacketShaper, which uses L7 filter). Authors sampled the data sets to lower the amount of processed data, training data set is chosen from the campus trace.

The paper contains very good related work chapter and description of classification algorithms with references.},
  Timestamp                = {2014.10.03}
}

@InCollection{Alshammari-2009-Preliminary,
  Title                    = {{A Preliminary Performance Comparison of Two Feature Sets for Encrypted Traffic Classification}},
  Author                   = {Alshammari, Riyad and Zincir-Heywood, A. Nur},
  Booktitle                = {Proceedings of the International Workshop on Computational Intelligence in Security for Information Systems CISIS’08},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2009},
  Pages                    = {203-210},
  Series                   = {Advances in Soft Computing},
  Volume                   = {53},

  Abstract                 = {The objective of this work is the comparison of two types of feature sets for the classification of encrypted traffic such as SSH. To this end, two learning algorithms – RIPPER and C4.5 – are employed using packet header and flow-based features. Traffic classification is performed without using features such as IP addresses, source/destination ports and payload information. Results indicate that the feature set based on packet header information is comparable with flow based feature set in terms of a high detection rate and a low false positive rate.},
  Doi                      = {10.1007/978-3-540-88181-0_26},
  ISBN                     = {978-3-540-88180-3},
  Keywords                 = {Encrypted Traffic Classification; Packet; Flow; and Security},
  Language                 = {English},
  Location                 = {Genoa, Italy},
  Owner                    = {velan},
  Review                   = {Two types of feature sets are compared: packet header based and flow based. The SSH traffic is used as an etalon for the comparison. The packet header feature set contains information from packet headers with the exception of IP addresses and transport protocol ports. It also contains packet inter-arrival time. Flow feature set is calculated from one or more packets for each flow. RIPPER and C4.5 classification algorithms are used to compare selected feature sets. The C4.5 classifier showed better results in detection rate and false positive rate. The results provided by both feature sets seems to be comparable. Authors claim that SSH traffic detection is possible even without packet payload and that it requires less processing power.},
  Timestamp                = {2014.10.06},
  Url                      = {http://dx.doi.org/10.1007/978-3-540-88181-0_26}
}

@InProceedings{Alshammari-2007-flow,
  Title                    = {{A Flow Based Approach for SSH Traffic Detection}},
  Author                   = {Alshammari, Riyad and Zincir-Heywood, A. Nur},
  Booktitle                = {Systems, Man and Cybernetics, 2007. ISIC. IEEE International Conference on},
  Year                     = {2007},
  Month                    = Oct,
  Pages                    = {296-301},

  Abstract                 = {The basic objective of this work is to assess the utility of two supervised learning algorithms AdaBoost and RIPPER for classifying SSH traffic from log files without using features such as payload, IP addresses and source/destination ports. Pre-processing is applied to the traffic data to express as traffic flows. Results of 10-fold cross validation for each learning algorithm indicate that a detection rate of 99\% and a false positive rate of 0.7\% can be achieved using RIPPER. Moreover, promising preliminary results were obtained when RIPPER was employed to identify which service was running over SSH. Thus, it is possible to detect SSH traffic with high accuracy without using features such as payload, IP addresses and source/destination ports, where this represents a particularly useful characteristic when requiring generic, scalable solutions.},
  Doi                      = {10.1109/ICSMC.2007.4414006},
  Keywords                 = {IP networks;learning (artificial intelligence);telecommunication network management;telecommunication security;telecommunication traffic;AdaBoost;IP address;RIPPER;SSH traffic detection;payload;source/destination ports;supervised learning algorithms;traffic data;traffic flows;Application software;Computer science;Cryptography;Engineering management;Financial management;Inspection;Payloads;Supervised learning;Telecommunication traffic;Traffic control},
  Location                 = {Montreal, Quebec, Canada},
  Owner                    = {velan},
  Review                   = {AdaBoost and RIPPER classification algorithms were compared on traces of SSH traffic. No payload, IP addresses nor ports were used for the classification. First the authors concentrate on automatic recognition of SSH traffic. Then they develop automatic recognition of different services and applications running over SSH. NLARN and MAWI public data sets are used for the first phase (GT is gained from port numbers), private data set is used for the second phase, since authors need to establish a ground truth. NetMate is used to extract features from the traffic. Authors show that RIPPER provides better detection rate and lower false positive rate on their data sets for both SSH detection and application classification.},
  Timestamp                = {2014.10.17}
}

@InProceedings{Amoli-2013-real,
  Title                    = {{A Real Time Unsupervised NIDS for Detecting Unknown and Encrypted Network Attacks in High Speed Network}},
  Author                   = {Amoli, Payam Vahdani and Hamalainen, Timo},
  Booktitle                = {Measurements and Networking Proceedings (M N), 2013 IEEE International Workshop on},
  Year                     = {2013},
  Month                    = Oct,
  Pages                    = {149-154},

  Abstract                 = {Previously, Network Intrusion Detection Systems (NIDS) detected intrusions by comparing the behaviour of the network to the pre-defined rules or pre-observed network traffic, which was expensive in terms of both cost and time. Unsupervised machine learning techniques have overcome these issues and can detect unknown and complex attacks within normal or encrypted communication without any prior knowledge. NIDS monitors bytes, packets and network flow to detect intrusions. It is nearly impossible to monitor the payload of all packets in a high-speed network. On the other hand, the content of packets does not have sufficient information to detect a complex attack. Since the rate of attacks within encrypted communication is increasing and the content of encrypted packets is not accessible to NIDS, it has been suggested to monitor network flows. As most network intrusions spread within the network very quickly, in this paper we will propose a new real-time unsupervised NIDS for detecting new and complex attacks within normal and encrypted communications. To achieve having a real-time NIDS, the proposed model should capture live network traffic from different sensors and analyse specific metrics such as number of bytes, packets, network flows, and the time explicitly and implicitly, of packets and network flows, in the different resolutions. The NIDS will flag the time slot as an anomaly if any of those metrics passes the threshold, and it will send the time slot to the first engine. The first engine clusters different layers and dimensions of the network's behaviour and correlates the outliers to purge the intrusions from normal traffic. Detecting network attacks, which produce a huge amount of network traffic (e.g. DOS, DDOS, scanning) was the aim of proposing the first engine. Analysing statistics of network flows increases the feasibility of detecting intrusions within encrypted communications. The aim of proposing the second engine is to conduct a deeper analysis a- d correlate the traffic and behaviour of Bots (current attackers) during DDOS attacks to find the Bot-Master.},
  Doi                      = {10.1109/IWMN.2013.6663794},
  Keywords                 = {cryptography;telecommunication traffic;unsupervised learning;Bot-Master;DBScan algorithm;DOS;denial of service;encrypted communication;encrypted network traffic;high speed network;live network traffic;network flow monitoring;network intrusion detection systems;real time unsupervised NIDS;time slot;unsupervised machine learning;Clustering algorithms;Cryptography;Engines;IP networks;Monitoring;Real-time systems;Telecommunication traffic;Clustering;Encrypted Network Traffic;NIDS;Network Flows;Unsupervised Intelligent Engine},
  Location                 = {Naples, Italy},
  Owner                    = {velan},
  Review                   = {In the introduction, authors describe possible approaches to detecting attacks in encrypted traffic. They propose a real-time unsupervised NIDS for detection attacks in ecrypted communication. First engine of the NIDS detects DoS, DDoS, etc. The second engine analyse the attack to identify a botnet master behind the attacks. To detect anomalies in the first engine, authors use multi-clustering algorithms. Encrypted traffic is not explicitly identified, but the attacks are detected in it.},
  Timestamp                = {2014.08.06}
}

@InProceedings{Antichi-2012-Enabling,
  Title                    = {{Enabling open-source high speed network monitoring on NetFPGA}},
  Author                   = {Antichi, Gianni and Giordano, Stefano and Miller, David J. and Moore, Andrew W.},
  Booktitle                = {Network Operations and Management Symposium (NOMS), 2012 IEEE},
  Year                     = {2012},
  Month                    = apr,
  Pages                    = {1029-1035},

  Abstract                 = {Network measurement both as diagnostic and within measurement-based techniques of traffic engineering and management, alongside network measurement for security has maintained the needs of researchers and network operators for the ongoing development of measurement tools for traffic monitoring/characterisation and to support Intrusion Detection Systems (IDSs). Many such tools capitalise on the pricing of commodity hardware by operating on general purpose architectures. Many are based on the well known libpcap API, a de facto standard in this area. Despite the many improvements that have been applied to packet capturing, packet-monitoring implementations still suffer from either: performance flaws on commodity hardware due mainly to unresolvable hardware bottlenecks, or costly and inflexible niche systems. To address such issues, the paper proposes a system architecture based on the cooperation of NetFPGA and a general purpose host PC. The NetFPGA is an open networking platform accelerator that enables rapid development of hardware-accelerated packet processing applications. The objective is to combine the high performance of a hardware-oriented solution with the flexibility of general purpose PCs.},
  Doi                      = {10.1109/NOMS.2012.6212025},
  ISSN                     = {1542-1201},
  Keywords                 = {application program interfaces;computer architecture;computer network management;computer network security;field programmable gate arrays;telecommunication traffic;IDS;NetFPGA;commodity hardware pricing;diagnostic technique;general purpose architectures;general purpose host PC;hardware-accelerated packet processing applications;intrusion detection systems;libpcap API;network measurement;niche systems;open networking platform accelerator;open-source high speed network monitoring;packet capturing;packet-monitoring;performance flaws;traffic characterisation;traffic engineering;traffic management;traffic monitoring;unresolvable hardware bottlenecks;within-measurement-based technique;Accuracy;Computer architecture;Hardware;Monitoring;Oscillators;Radiation detectors;Software},
  Owner                    = {velan},
  Timestamp                = {2014.08.28}
}

@InProceedings{Arndt-2011-Comparison,
  Title                    = {{A Comparison of Three Machine Learning Techniques for Encrypted Network Traffic Analysis}},
  Author                   = {Arndt, Daniel J. and Zincir-Heywood, A. Nur},
  Booktitle                = {Computational Intelligence for Security and Defense Applications (CISDA), 2011 IEEE Symposium on},
  Year                     = {2011},
  Month                    = Apr,
  Pages                    = {107-114},

  Abstract                 = {This work evaluates three methods for encrypted traffic analysis without using the IP addresses, port number, and payload information. To this end, binary identification of SSH vs non-SSH traffic is used as a case study since the plain text initiation of the SSH protocol allows us to obtain data sets with a reliable ground truth. The methods are subject to several tests using different export options, feature sets, and training and test traffic traces for a total of 128 different configurations. Of particular interest are test cases which that use a test set from a different network than that which the model was trained on, i.e. robustness of the trained models. Results show that the multi-objective genetic algorithm (MOGA) based trained model is able to achieve the best performance among the three methods when each approach is tested on traffic traces that are captured on the same network as the training network trace. On the other hand, C4.5 achieved the best results among the three methods when tested on traffic traces which are captured on totally different networks than the training trace. Furthermore, it is shown that continuous sampling of the training data is no better than random sampling, but the training data is very important for how well the classifiers will perform on traffic traces captured from different networks. Moreover, the C4.5 based approach provides the fastest and the most human readable model, whereas the MOGA reduces the complexity of the k-means clustering algorithm tremendously.},
  Doi                      = {10.1109/CISDA.2011.5945941},
  Keywords                 = {IP networks;cryptography;genetic algorithms;learning (artificial intelligence);pattern clustering;protocols;telecommunication traffic;C4.5-based approach;IP addresses;MOGA-based trained model;SSH protocol;binary identification;encrypted network traffic analysis;feature sets;k-mean clustering;machine learning techniques;multiobjective genetic algorithm;nonSSH traffic;payload information;port number;random sampling;traffic traces;Clustering algorithms;Equations;Mathematical model;Payloads;Protocols;Robustness;Training},
  Location                 = {Paris, France},
  Owner                    = {velan},
  Review                   = {Authors compare C4.5, k-means and multi-objective genetic algorithm (MOGA). All methods are evaluated on multiple data sets when identifying SSH traffic. Full flows are used, times to train the methods and evaluate testing data are compared. C4.5 provides the best robustness and MOGA has very low false positive rate when used on the same data set as it was trained on. C4.5 is recommended for forensic analysis by law enforcement.},
  Timestamp                = {2014.08.25}
}

@InProceedings{Augustin-2011-Traffic,
  Title                    = {{On Traffic Patterns of HTTP Applications}},
  Author                   = {Augustin, Brice and Mellouk, Abdelhamid},
  Booktitle                = {Global Telecommunications Conference (GLOBECOM 2011), 2011 IEEE},
  Year                     = {2011},
  Month                    = dec,

  Doi                      = {10.1109/GLOCOM.2011.6134438},
  ISSN                     = {1930-529X},
  Keywords                 = {Internet;hypermedia;pattern classification;quality of service;telecommunication traffic;time series;transport protocols;HTTP application;Internet protocol;QoS;RRDTool database;Web application;audio streaming;browser-generated traffic;chat;documents editing;email;hypertext documents;pattern classification;plot time series;security policy;traffic pattern;video streaming;Bandwidth;Browsers;Electronic mail;Google;Protocols;Streaming media;YouTube},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{mse-specification,
  Title                    = {{Message Stream Encryption.} \textit{Vuze Wiki}},
  Author                   = {{Azureus Software Inc.}},
  Url                      = {http://wiki.vuze.com/w/Message_Stream_Encryption},
  Urldate                  = {2014-10-31},

  Month                    = May,
  Year                     = {2014},

  Keywords                 = {Message Stream Encryption, MSE, specification},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03}
}

@InProceedings{Bacquet-2011-Genetic,
  Title                    = {{Genetic Optimization and Hierarchical Clustering Applied to Encrypted Traffic Identification}},
  Author                   = {Bacquet, Carlos and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},
  Booktitle                = {Computational Intelligence in Cyber Security (CICS), 2011 IEEE Symposium on},
  Year                     = {2011},
  Month                    = Apr,
  Pages                    = {194-201},

  Abstract                 = {An important part of network management requires the accurate identification and classification of network traffic for decisions regarding bandwidth management, quality of service, and security. This work explores the use of a Multi-Objective Genetic Algorithm (MOGA) for both, feature selection and cluster count optimization, for an unsupervised machine learning technique, K-Means, applied to encrypted traffic identification. Specifically, a hierarchical K-Means algorithm is employed, comparing its performance to the MOGA with a non-hierarchical (flat) K-Means algorithm. The latter has already been benchmarked against common unsupervised techniques found in the literature, where results have favored the proposed MOGA. The purpose of this paper is to explore the gains, if any, obtained by increasing cluster purity in the proposed model by means of a second layer of clusters. In this work, SSH is chosen as an example of an encrypted application. However, nothing prevents the proposed model to work with other types of encrypted traffic, such as SSL or Skype. Results show that with the hierarchical MOGA, significant gains are observed in terms of the classification performance of the system.},
  Doi                      = {10.1109/CICYBS.2011.5949391},
  Keywords                 = {genetic algorithms;pattern clustering;quality of service;telecommunication computing;telecommunication network management;telecommunication traffic;unsupervised learning;QoS;SSL;Skype;bandwidth management;cluster count optimization;encrypted traffic identification;feature selection;hierarchical clustering;k-means algorithm;multiobjective genetic algorithm;network management;network traffic;quality of service;unsupervised machine learning;Accuracy;Clustering algorithms;Cryptography;Genetic algorithms;Machine learning;Optimization;Payloads},
  Location                 = {Paris, France},
  Owner                    = {velan},
  Review                   = {Authors use Multi-Objective Genetic Algorithm for feature selection as well as for improving K-means method. Authors add a second layer of clusters and study the improvements. SSH was chosen as an example of encrypted traffic, only the categories SSH and non-SSH are used. Authors use private data set with truncated payload and was labeled by commercial tools. Authors consider the ground truth 100\% accurate, although they do not justify this accuracy when the payload is removed. Training data contained SSH, MSN, HTTP, FTP, and DNS. The data set was randomly sampled. Test data set contained more protocols, such as IMAP, SNMP, LDAP, POP3. 38 flow features were available to MOGA algorithm, number of used flow features by the best individuals is not known.},
  Timestamp                = {2015.03.13}
}

@InCollection{Bacquet-2009-Investigation,
  Title                    = {{An Investigation of Multi-objective Genetic Algorithms for Encrypted Traffic Identification}},
  Author                   = {Bacquet, Carlos and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},
  Booktitle                = {Computational Intelligence in Security for Information Systems},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2009},
  Pages                    = {93-100},
  Series                   = {Advances in Intelligent and Soft Computing},
  Volume                   = {63},

  Abstract                 = {The increasing use of encrypted traffic combined with non-standard port associations makes the task of traffic identification increasingly difficult. This work adopts a multi-objective clustering approach to the problem in which a Genetic Algorithm performs both feature selection and cluster count optimization under a flow based representation. Solutions do not use port numbers, IP address or payload. Performance of the resulting model provides 90\% detection 0.8\% false positive rates with 13 clusters supported by 14 of the original 38 features.},
  Doi                      = {10.1007/978-3-642-04091-7_12},
  ISBN                     = {978-3-642-04090-0},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {SSH is chosen as an example of encrypted traffic for this work. Multi-Objective Genetic Algorithm is used to determine the best flow feature subspace and clustering of traffic types. Based on previous works authors argue that the feature selection and number of clusters highly affect the overall accuracy. Authors selected four features and in 25 runs of the MOGA tried to find the best Pareto non-dominated solution. They managed to obtain a solution with 92\% detection rate and only 0.8\% false positive rate.},
  Timestamp                = {2014.10.06},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-04091-7_12}
}

@InProceedings{Bahaman-2012-Network,
  Title                    = {{Network performance evaluation of 6to4 tunneling}},
  Author                   = {Bahaman, Nazrulazhar and Hamid, Erman and Prabuwono, Anton Satria},
  Booktitle                = {2012 International Conference on Innovation Management and Technology Research},
  Year                     = {2012},
  Month                    = may,
  Pages                    = {263-268},

  Doi                      = {10.1109/ICIMTR.2012.6236400},
  Keywords                 = {IP networks;computer network performance evaluation;data communication;transport protocols;6to4 tunneling;IPv4 protocol;IPv6 transition mechanisms;TCP data transmission;TCP transmission protocol;UDP transmission protocol;User Datagram Protocol;network performance evaluation;round trip time;throughput;tunneling overhead;user-to-user network performance software;Force;IP networks;Internet;Routing protocols;Throughput;Tunneling;6to4;Protocol-41;TCP;Tunneling;UDP},
  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Online{hippie,
  Title                    = {{HiPPIE}},
  Author                   = {Ballard, Josh},
  Url                      = {http://sourceforge.net/projects/hippie/},
  Urldate                  = {2014-11-26},

  Month                    = Apr,
  Year                     = {2013},

  Keywords                 = {hippie, traffic classification},
  Owner                    = {Milan},
  Timestamp                = {2014.12.01}
}

@InProceedings{Barbette-2015-Fast,
  Title                    = {{Fast Userspace Packet Processing}},
  Author                   = {Barbette, Tom and Soldani, Cyril and Mathy, Laurent},
  Booktitle                = {Proceedings of the Eleventh ACM/IEEE Symposium on Architectures for Networking and Communications Systems},
  Year                     = {2015},

  Address                  = {Washington, DC, USA},
  Pages                    = {5--16},
  Publisher                = {IEEE Computer Society},
  Series                   = {ANCS '15},

  Acmid                    = {2772727},
  ISBN                     = {978-1-4673-6632-8},
  Keywords                 = {click modular router, fast packet i/o, high-speed net- working, intel dpdk, multi-queue, netmap, network processing., numa, userspace i/o},
  Location                 = {Oakland, California, USA},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.02.13},
  Url                      = {http://dl.acm.org/citation.cfm?id=2772722.2772727}
}

@InCollection{BarYanai-2010-Realtime,
  Title                    = {{Realtime Classification for Encrypted Traffic}},
  Author                   = {Bar-Yanai, Roni and Langberg, Michael and Peleg, David and Roditty, Liam},
  Booktitle                = {Experimental Algorithms},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2010},
  Pages                    = {373-385},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {6049},

  Abstract                 = {Classifying network flows by their application type is the backbone of many crucial network monitoring and controlling tasks, including billing, quality of service, security and trend analyzers. The classical “port-based” and “payload-based” approaches to traffic classification have several shortcomings. These limitations have motivated the study of classification techniques that build on the foundations of learning theory and statistics. The current paper presents a new statistical classifier that allows real time classification of encrypted data. Our method is based on a hybrid combination of the k-means and k-nearest neighbor (or k-NN) geometrical classifiers. The proposed classifier is both fast and accurate, as implied by our feasibility tests, which included implementing and intergrading statistical classification into a realtime embedded environment. The experimental results indicate that our classifier is extremely robust to encryption.},
  Doi                      = {10.1007/978-3-642-13193-6_32},
  ISBN                     = {978-3-642-13192-9},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {Authors use combination of k-means and k-nearest neighbor classifiers to classify network flows. They claim the method to be fast, accurate and robust to encryption, asymmetric routing and packet ordering. The BitTorrent traffic is hard to identify since the community put a lot of effort into detection avoidance. First few packets of encrypted communication are often padded to avoid detection using only first packets. Authors stress that their method is applicable in realtime ienvironment and tested it on an ISP link. First 100 packets are used for the classification. The application protocols classified are HTTP, SMTP, POP3, Skype, eDonkey, BitTorrent, Encrypted Bittorrent, RTP, ICQ.},
  Timestamp                = {2014.10.06},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-13193-6_32}
}

@InProceedings{Benson-2010-Network,
  Title                    = {{Network Traffic Characteristics of Data Centers in the Wild}},
  Author                   = {Benson, Theophilus and Akella, Aditya and Maltz, David A.},
  Booktitle                = {Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2010},

  Address                  = {New York, NY, USA},
  Pages                    = {267--280},
  Publisher                = {ACM},
  Series                   = {IMC '10},

  Abstract                 = {Although there is tremendous interest in designing improved networks for data centers, very little is known about the network-level traffic characteristics of data centers today. In this paper, we conduct an empirical study of the network traffic in 10 data centers belonging to three different categories, including university, enterprise campus, and cloud data centers. Our definition of cloud data centers includes not only data centers employed by large online service providers offering Internet-facing applications but also data centers used to host data-intensive (MapReduce style) applications). We collect and analyze SNMP statistics, topology and packet-level traces. We examine the range of applications deployed in these data centers and their placement, the flow-level and packet-level transmission properties of these applications, and their impact on network and link utilizations, congestion and packet drops. We describe the implications of the observed traffic patterns for data center internal traffic engineering as well as for recently proposed architectures for data center networks.},
  Acmid                    = {1879175},
  Doi                      = {10.1145/1879141.1879175},
  ISBN                     = {978-1-4503-0483-2},
  Keywords                 = {characterization, data center traffic},
  Location                 = {Melbourne, Australia},
  Numpages                 = {14},
  Owner                    = {velan},
  Timestamp                = {2015.07.27}
}

@InProceedings{Bernaille-2007-Early,
  Title                    = {{Early Recognition of Encrypted Applications}},
  Author                   = {Bernaille, Laurent and Teixeira, Renata},
  Booktitle                = {Proceedings of the 8th International Conference on Passive and Active Network Measurement},
  Year                     = {2007},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {165--175},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'07},

  Abstract                 = {Most tools to recognize the application associated with network connections use well-known signatures as basis for their classification. This approach is very effective in enterprise and campus networks to pinpoint forbidden applications (peer to peer, for instance) or security threats. However, it is easy to use encryption to evade these mechanisms. In particular, Secure Sockets Layer (SSL) libraries such as OpenSSL are widely available and can easily be used to encrypt any type of traffic. In this paper, we propose a method to detect applications in SSL encrypted connections. Our method uses only the size of the first few packets of an SSL connection to recognize the application, which enables an early classification. We test our method on packet traces collected on two campus networks and on manually-encrypted traces. Our results show that we are able to recognize the application in an SSL connection with more than 85\% accuracy.},
  Acmid                    = {1762911},
  ISBN                     = {978-3-540-71616-7},
  Location                 = {Louvain-la-Neuve, Belgium},
  Numpages                 = {11},
  Owner                    = {velan},
  Review                   = {Authors 1) detect and describe encrypted traffic (SSL) in a campus network and 2) use clustering method to detect SSL and identify the underlying application. The detection of encrypted traffic in 1) is done using first 4 bytes of payload to read SSL version and packet length. Authors use traffic traces from live networks and manually generated packet trace to verify their approach. The traffic classification uses clustering algorithm (Gaussian Mixture Model). First they use sizes and directions of first P packets to determine whether the flow is SSL. Using first three packets and 35 clusters gives good results. The method then searches for first data packet in the connection and uses the same clustering on data packet sizes to detect underlying application. However, the packet sizes are modified to allow for encryption overhead. Using combination of clustering and port numbers to differentiate applications in clusters provides better results that clustering alone.},
  Timestamp                = {2014.09.26},
  Url                      = {http://dl.acm.org/citation.cfm?id=1762888.1762911}
}

@Article{Bhuyan-2011-Surveying,
  Title                    = {{Surveying Port Scans and Their Detection Methodologies}},
  Author                   = {Bhuyan, Monowar H. and Bhattacharyya, D.K. and Kalita, J.K.},
  Journal                  = {Comput. J.},
  Year                     = {2011},

  Month                    = oct,
  Number                   = {10},
  Pages                    = {1565--1581},
  Volume                   = {54},

  Acmid                    = {2061885},
  Address                  = {Oxford, UK},
  ISSN                     = {0010-4620},
  Issue_date               = {October 2011},
  Numpages                 = {17},
  Owner                    = {velan},
  Publisher                = {Oxford University Press},
  Timestamp                = {2017.10.20}
}

@InProceedings{Billig-2008-Evaluation,
  Title                    = {{Evaluation of Google Hacking}},
  Author                   = {Billig, Justin and Danilchenko, Yuri and Frank, Charles E.},
  Booktitle                = {Proceedings of the 5th Annual Conference on Information Security Curriculum Development},
  Year                     = {2008},

  Address                  = {New York, NY, USA},
  Pages                    = {27--32},
  Publisher                = {ACM},
  Series                   = {InfoSecCD '08},

  ISBN                     = {978-1-60558-333-4},
  Keywords                 = {Google hacking, hacking, information assurance, information security, web security},
  Location                 = {Kennesaw, Georgia},
  Numpages                 = {6},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{Bittel-2014-httpry,
  Title                    = {{httpry - HTTP logging and information retrieval tool}},
  Author                   = {Bittel, Jason},
  Url                      = {http://github.com/jbittel/httpry},
  Urldate                  = {2017-10-18},

  Month                    = oct,
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@MastersThesis{Blatter-2011-Extending,
  Title                    = {{Extending HAPviewer: Time Window, Flow Classification, and Geolocation}},
  Author                   = {Blatter, Raphael Thomas},
  School                   = {University of Zurich, Department of Informatics},
  Year                     = {2011},

  Owner                    = {velan},
  Timestamp                = {2017.10.25},
  Url                      = {ftp://ftp.tik.ee.ethz.ch:21/pub/students/2011-FS/MA-2011-12.pdf}
}

@InProceedings{Bonelli-2012-Multi,
  Title                    = {{On Multi---gigabit Packet Capturing with Multi---core Commodity Hardware}},
  Author                   = {Bonelli, Nicola and Di Pietro, Andrea and Giordano, Stefano and Procissi, Gregorio},
  Booktitle                = {Proceedings of the 13th International Conference on Passive and Active Measurement},
  Year                     = {2012},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {64--73},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'12},

  Acmid                    = {2238905},
  Doi                      = {10.1007/978-3-642-28537-0_7},
  ISBN                     = {978-3-642-28536-3},
  Location                 = {Vienna, Austria},
  Numpages                 = {10},
  Owner                    = {velan},
  Timestamp                = {2018.02.13},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-28537-0_7}
}

@InProceedings{Bonelli-2017-Enabling,
  Title                    = {{Enabling Packet Fan-Out in the libpcap Library for Parallel Traffic Processing}},
  Author                   = {Bonelli, Nicola and Giordano, Stefano and Procissi, Gregorio},
  Booktitle                = {2017 Network Traffic Measurement and Analysis Conference (TMA)},
  Year                     = {2017},
  Month                    = jun,
  Pages                    = {1-9},

  Doi                      = {10.23919/TMA.2017.8002904},
  Keywords                 = {IP networks;Linux;application program interfaces;multi-threading;multiprocessing systems;network interfaces;parallel architectures;telecommunication computing;telecommunication traffic;user interfaces;API;Bro;Linux operating-system;PFQ accelerated engine;Tstat;accelerated capture engines;application level parallelism;capture technologies;commodity PC;computation intensive operations;declarative grammar configuration;legacy applications;libpcap library;multicore architecture;multigigabit network cards;multiple processing cores;multiprocess applications;multithreaded applications;native multicore support;network applications;packet fan-out;parallel traffic processing;pcap library interface;standard Linux socket;traffic rates;Acceleration;Engines;Instruction sets;Libraries;Linux;Sockets;Standards},
  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Article{Bonelli-2016-Network,
  Title                    = {{Network Traffic Processing With PFQ}},
  Author                   = {Bonelli, Nicola and Giordano, Stefano and Procissi, Gregorio},
  Journal                  = {IEEE Journal on Selected Areas in Communications},
  Year                     = {2016},

  Month                    = jun,
  Number                   = {6},
  Pages                    = {1819-1833},
  Volume                   = {34},

  Doi                      = {10.1109/JSAC.2016.2558998},
  ISSN                     = {0733-8716},
  Keywords                 = {Linux;computer networks;operating system kernels;queueing theory;telecommunication traffic;Linux kernel;PFQ;network device drivers;network traffic processing;open-source module;packet family queue;packet processing;pcap library;programming interfaces;software-accelerated packet;Acceleration;Kernel;Linux;Monitoring;Parallel processing;Performance evaluation;Application Offload;Concurrent Programming;Early Stage Processing;Multi–Core Architectures;Multi–Queue NICs;Network Monitoring;Network monitoring;application offload;concurrent programming;early stage processing;multi–core architectures;multi–queue NICs},
  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@InProceedings{Bonelli-2014-Purely,
  Title                    = {{A Purely Functional Approach to Packet Processing}},
  Author                   = {Bonelli, Nicola and Giordano, Stefano and Procissi, Gregorio and Abeni, Luca},
  Booktitle                = {Proceedings of the Tenth ACM/IEEE Symposium on Architectures for Networking and Communications Systems},
  Year                     = {2014},

  Address                  = {New York, NY, USA},
  Pages                    = {219--230},
  Publisher                = {ACM},
  Series                   = {ANCS '14},

  Acmid                    = {2658269},
  Doi                      = {10.1145/2658260.2658269},
  ISBN                     = {978-1-4503-2839-5},
  Keywords                 = {pfq, software defined networking},
  Location                 = {Los Angeles, California, USA},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.02.13},
  Url                      = {http://doi.acm.org/10.1145/2658260.2658269}
}

@InProceedings{Brauckhoff-2006-Impact,
  Title                    = {{Impact of Packet Sampling on Anomaly Detection Metrics}},
  Author                   = {Brauckhoff, Daniela and Tellenbach, Bernhard and Wagner, Arno and May, Martin and Lakhina, Anukool},
  Booktitle                = {Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2006},

  Address                  = {New York, NY, USA},
  Pages                    = {159--164},
  Publisher                = {ACM},
  Series                   = {IMC '06},

  Abstract                 = {Packet sampling methods such as Cisco's NetFlow are widely employed by large networks to reduce the amount of traffic data measured. A key problem with packet sampling is that it is inherently a lossy process, discarding (potentially useful) information. In this paper, we empirically evaluate the impact of sampling on anomaly detection metrics. Starting with unsampled flow records collected during the Blaster worm outbreak, we reconstruct the underlying packet trace and simulate packet sampling at increasing rates. We then use our knowledge of the Blaster anomaly to build a baseline of normal traffic (without Blaster), against which we can measure the anomaly size at various sampling rates. This approach allows us to evaluate the impact of packet sampling on anomaly detection without being restricted to (or biased by) a particular anomaly detection method.We find that packet sampling does not disturb the anomaly size when measured in volume metrics such as the number of bytes and number of packets, but grossly biases the number of flows. However, we find that recently proposed entropy-based summarizations of packet and flow counts are affected less by sampling, and expose the Blaster worm outbreak even at higher sampling rates. Our findings suggest that entropy summarizations are more resilient to sampling than volume metrics. Thus, while not perfect, sampling still preserves sufficient distributional structure, which when harnessed by tools like entropy, can expose hard-to-detect scanning anomalies.},
  Acmid                    = {1177101},
  Doi                      = {10.1145/1177080.1177101},
  ISBN                     = {1-59593-561-4},
  Keywords                 = {anomaly detection, network traffic analysis, sampling},
  Location                 = {Rio de Janeriro, Brazil},
  Numpages                 = {6},
  Owner                    = {velan},
  Timestamp                = {2016.03.03},
  Url                      = {http://doi.acm.org/10.1145/1177080.1177101}
}

@InProceedings{Braun-2010-Comparing,
  Title                    = {{Comparing and Improving Current Packet Capturing Solutions Based on Commodity Hardware}},
  Author                   = {Braun, Lothar and Didebulidze, Alexander and Kammenhuber, Nils and Carle, Georg},
  Booktitle                = {Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2010},

  Address                  = {New York, NY, USA},
  Pages                    = {206--217},
  Publisher                = {ACM},
  Series                   = {IMC '10},

  Acmid                    = {1879168},
  Doi                      = {10.1145/1879141.1879168},
  ISBN                     = {978-1-4503-0483-2},
  Keywords                 = {measurement, operating systems, packet capturing},
  Location                 = {Melbourne, Australia},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.02.13},
  Url                      = {http://doi.acm.org/10.1145/1879141.1879168}
}

@Article{Brownlee-2011-Flow,
  Title                    = {{Flow-Based Measurement: IPFIX Development and Deployment}},
  Author                   = {Brownlee, Nevil},
  Journal                  = {IEICE Transactions on Communications},
  Year                     = {2011},

  Month                    = sep,
  Number                   = {8},
  Pages                    = {2190--2198},
  Volume                   = {E94.B},

  Doi                      = {10.1587/transcom.E94.B.2190},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Article{Bujlow-2015-classification,
  Title                    = {{Independent Comparison of Popular DPI Tools for Traffic Classification}},
  Author                   = {Bujlow, Tomasz and Carela-Espanol, Valentín and Barlet-Ros, Pere},
  Journal                  = {Computer Networks},
  Year                     = {2015},
  Number                   = {0},
  Pages                    = {75 - 89},
  Volume                   = {76},

  Abstract                 = {Deep Packet Inspection (DPI) is the state-of-the-art technology for traffic classification. According to the conventional wisdom, DPI is the most accurate classification technique. Consequently, most popular products, either commercial or open-source, rely on some sort of DPI for traffic classification. However, the actual performance of DPI is still unclear to the research community, since the lack of public datasets prevent the comparison and reproducibility of their results. This paper presents a comprehensive comparison of 6 well-known DPI tools, which are commonly used in the traffic classification literature. Our study includes 2 commercial products (PACE and NBAR) and 4 open-source tools (OpenDPI, L7-filter, nDPI, and Libprotoident). We studied their performance in various scenarios (including packet and flow truncation) and at different classification levels (application protocol, application and web service). We carefully built a labeled dataset with more than 750 K flows, which contains traffic from popular applications. We used the Volunteer-Based System (VBS), developed at Aalborg University, to guarantee the correct labeling of the dataset. We released this dataset, including full packet payloads, to the research community. We believe this dataset could become a common benchmark for the comparison and validation of network traffic classifiers. Our results present PACE, a commercial tool, as the most accurate solution. Surprisingly, we find that some open-source tools, such as nDPI and Libprotoident, also achieve very high accuracy.},
  Doi                      = {http://dx.doi.org/10.1016/j.comnet.2014.11.001},
  Keywords                 = {Deep packet inspection, DPI, traffic classification},
  Owner                    = {velan},
  Timestamp                = {2014.12.02},
  Url                      = {http://www.sciencedirect.com/science/article/pii/S1389128614003909}
}

@InProceedings{Caballero-2007-Polyglot,
  Title                    = {{Polyglot: Automatic Extraction of Protocol Message Format Using Dynamic Binary Analysis}},
  Author                   = {Caballero, Juan and Yin, Heng and Liang, Zhenkai and Song, Dawn},
  Booktitle                = {Proceedings of the 14th ACM Conference on Computer and Communications Security},
  Year                     = {2007},

  Address                  = {New York, NY, USA},
  Pages                    = {317--329},
  Publisher                = {ACM},
  Series                   = {CCS '07},

  Acmid                    = {1315286},
  Doi                      = {10.1145/1315245.1315286},
  ISBN                     = {978-1-59593-703-2},
  Keywords                 = {binary analysis, protocol reverse engineering},
  Location                 = {Alexandria, Virginia, USA},
  Numpages                 = {13},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://doi.acm.org/10.1145/1315245.1315286}
}

@Online{CAIDA-2013-Cyber,
  Title                    = {{Cyber-security Research Ethics Dialog \& Strategy Workshop}},
  Author                   = {{CAIDA}},
  Url                      = {http://www.caida.org/workshops/creds/1305/},
  Urldate                  = {2018-02-22},

  Month                    = may,
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2014.12.03}
}

@Article{Callado-2009-Survey,
  Title                    = {{A Survey on Internet Traffic Identification}},
  Author                   = {Callado, Arthur and Kamienski, Carlos and Szabo, Geza and Gero, Balazs Peter and Kelner, Judith and Fernandes, Stenio and Sadok, Djamel},
  Journal                  = {Communications Surveys \& Tutorials, IEEE},
  Year                     = {2009},

  Month                    = Aug,
  Number                   = {3},
  Pages                    = {37-52},
  Volume                   = {11},

  Abstract                 = {The area of Internet traffic measurement has advanced enormously over the last couple of years. This was mostly due to the increase in network access speeds, due to the appearance of bandwidth-hungry applications, due to the ISPs' increased interest in precise user traffic profile information and also a response to the enormous growth in the number of connected users. These changes greatly affected the work of Internet service providers and network administrators, which have to deal with increasing resource demands and abrupt traffic changes brought by new applications. This survey explains the main techniques and problems known in the field of IP traffic analysis and focuses on application detection. First, it separates traffic analysis into packet-based and flow-based categories and details the advantages and problems for each approach. Second, this work cites the techniques for traffic analysis accessible in the literature, along with the analysis performed by the authors. Relevant techniques include signature-matching, sampling and inference. Third, this work shows the trends in application classification analysis and presents important and recent references in the subject. Lastly, this survey draws the readers' interest to open research topics in the area of traffic analysis and application detection and makes some final remarks.},
  Doi                      = {10.1109/SURV.2009.090304},
  ISSN                     = {1553-877X},
  Keywords                 = {Internet;telecommunication traffic;ISP;Internet service provider;Internet traffic identification;bandwidth-hungry applications;flow-based traffic analysis;packet-based traffic analysis;Area measurement;Availability;IP networks;Loss measurement;Peer to peer computing;Performance analysis;Sampling methods;Telecommunication traffic;Video sharing;Web and internet services;Measurement, Application Identification, Traffic Analysis, Classification},
  Owner                    = {velan},
  Timestamp                = {2014.10.24}
}

@InCollection{Cao-2014-Survey,
  Title                    = {{A Survey on Encrypted Traffic Classification}},
  Author                   = {Cao, Zigang and Xiong, Gang and Zhao, Yong and Li, Zhenzhen and Guo, Li},
  Booktitle                = {Applications and Techniques in Information Security},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2014},
  Editor                   = {Batten, Lynn and Li, Gang and Niu, Wenjia and Warren, Matthew},
  Pages                    = {73-81},
  Series                   = {Communications in Computer and Information Science},
  Volume                   = {490},

  Abstract                 = {With the widespread use of encryption techniques in network applications, encrypted network traffic has recently become a great challenge for network management. Studies on encrypted traffic classification not only help to improve the network service quality, but also assist in enhancing network security. In this paper, we first introduce the basic information of encrypted traffic classification, emphasizing the influences of encryption on current classification methodology. Then, we summarize the challenges and recent advances in encrypted traffic classification research. Finally, the paper is ended with some conclusions.},
  Doi                      = {10.1007/978-3-662-45670-5_8},
  ISBN                     = {978-3-662-45669-9},
  Keywords                 = {traffic classification; encrypted traffic; statistical classification; fine-grained; behavior based},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {The survey provides brief introduction into encrypted traffic classification and points out main challenges in the field. Authors differentiate advances in acurate classification, multi-phased fine-grained classification and behavior based fine-grained classification. Brief section is dedicated to countermeasures of statistical traffic analysis. Authors conclude that use of multiple player classification framework may be a way to achieve fine-grained classification.},
  Timestamp                = {2015.03.11},
  Url                      = {http://dx.doi.org/10.1007/978-3-662-45670-5_8}
}

@InProceedings{Cejka-2015-Using,
  Title                    = {{Using Application-Aware Flow Monitoring for SIP Fraud Detection}},
  Author                   = {Cejka, Tomas and Bartos, Vaclav and Truxa, Lukas and Kubatova, Hana},
  Booktitle                = {Intelligent Mechanisms for Network Configuration and Security: 9th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2015, Ghent, Belgium, June 22-25, 2015. Proceedings},
  Year                     = {2015},

  Address                  = {Cham},
  Editor                   = {Latr{\'e}, Steven and Charalambides, Marinos and Fran{\c{c}}ois, J{\'e}r{\^o}me and Schmitt, Corinna and Stiller, Burkhard},
  Pages                    = {87--99},
  Publisher                = {Springer International Publishing},

  Doi                      = {10.1007/978-3-319-20034-7_10},
  ISBN                     = {978-3-319-20034-7},
  Owner                    = {velan},
  Timestamp                = {2017.04.27},
  Url                      = {http://dx.doi.org/10.1007/978-3-319-20034-7_10}
}

@InProceedings{Celeda-2013-Large,
  Title                    = {{Large-Scale Geolocation for NetFlow}},
  Author                   = {Čeleda, Pavel and Velan, Petr and Rábek, Martin and Hofstede, Rick and Pras, Aiko},
  Booktitle                = {IFIP/IEEE International Symposium on Integrated Network Management (IM 2013)},
  Year                     = {2013},

  Address                  = {Ghent, Belgium},
  Editor                   = {De Turck, Filip and Diao, Yixin and Se on Hong, Choong and Medhi, Deep and Sadre, Ramin},
  Month                    = May,
  Pages                    = {1015-1020},
  Publisher                = {IEEE Xplore Digital Library},

  Abstract                 = {Current approaches perform geolocation mostly on-demand and in a small-scale fashion. As soon as geolocation needs to be performed in real-time in high-speed and large-scale networks, these approaches are not scalable anymore. To solve this pro
blem, we propose two approaches to large-scale geolocation. Firstly, we present an exporter-based approach, which adds geolocation data to flow records in a way that is transparent to any flow collector. Secondly, we present a flow collector-based approach, which adds nativ
e geolocation to NetFlow data from any flow exporter. After presenting prototypes for both approaches, we demonstrate the applicability of large-scale geolocation by means of use cases.},
  ISBN                     = {978-1-4673-5229-1},
  Keywords                 = {geolocation; GeoIP; ISO 3166; NetFlow; NFDUMP; NfSen; security; detection; anomaly},
  Location                 = {Ghent, Belgium},
  Owner                    = {velan},
  Timestamp                = {2014.04.23},
  Url                      = {http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6573124}
}

@Online{CSIS-2013-Economic,
  Title                    = {{The Economic Impact of Cubercrime and Cyber Espionage}},
  Author                   = {{Center for Strategic and International Studies}},
  Url                      = {http://csis.org/files/publication/60396rpt_cybercrime-cost_0713_ph4_0.pdf},
  Urldate                  = {2018-03-02},

  Month                    = jul,
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@InProceedings{Cermak-2016-Performance,
  Title                    = {{A Performance Benchmark for NetFlow Data Analysis on Distributed Stream Processing Systems}},
  Author                   = {Čermák, Milan and Tovarňák, Daniel and Laštovička, Martin and Čeleda, Pavel},
  Booktitle                = {NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium},
  Year                     = {2016},
  Month                    = Apr,
  Pages                    = {919-924},

  Doi                      = {10.1109/NOMS.2016.7502926},
  Keywords                 = {IP networks;computer network security;data analysis;NetFlow data analysis;distributed stream processing systems;network flow processing;security analysis algorithms;Benchmark testing;Data processing;Distributed databases;Fasteners;Real-time systems;Sparks;Storms},
  Owner                    = {velan},
  Timestamp                = {2017.08.04}
}

@Online{CERTNSAGET--yaf,
  Title                    = {{yaf application labeling}},
  Author                   = {{CERT Network Situational Awareness Group Engineering Team}},
  Url                      = {https://tools.netsa.cert.org/yaf/applabel.html},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@Online{CERTNSAT--SiLK,
  Title                    = {{SiLK}},
  Author                   = {{CERT Network Situational Awareness Team (NetSA)}},
  Url                      = {http://tools.netsa.cert.org/silk/},
  Urldate                  = {2012-12-13},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Article{Chandola-2009-Anomaly,
  Title                    = {{Anomaly Detection: A Survey}},
  Author                   = {Chandola, Varun and Banerjee, Arindam and Kumar, Vipin},
  Journal                  = {ACM Comput. Surv.},
  Year                     = {2009},

  Month                    = jul,
  Number                   = {3},
  Pages                    = {15:1--15:58},
  Volume                   = {41},

  Acmid                    = {1541882},
  Address                  = {New York, NY, USA},
  Articleno                = {15},
  Doi                      = {10.1145/1541880.1541882},
  ISSN                     = {0360-0300},
  Issue_date               = {July 2009},
  Keywords                 = {Anomaly detection, outlier detection},
  Numpages                 = {58},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.08.09},
  Url                      = {http://doi.acm.org/10.1145/1541880.1541882}
}

@Article{Cheng-2012-Evasion,
  Title                    = {{Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems}},
  Author                   = {Cheng, Tsung-Huan and Lin, Ying-Dar and Lai, Yuan-Cheng and Lin, Po-Ching},
  Journal                  = {IEEE Communications Surveys Tutorials},
  Year                     = {2012},

  Month                    = {10},
  Number                   = {4},
  Pages                    = {1011-1020},
  Volume                   = {14},

  Doi                      = {10.1109/SURV.2011.092311.00082},
  ISSN                     = {1553-877X},
  Keywords                 = {Computer crime;Cryptography;Handwriting recognition;IP networks;Intrusion detection;Payloads;IDS/IPS;attacks;evasion;signature},
  Owner                    = {velan},
  Timestamp                = {2017.06.22}
}

@Online{CiscoSystems--Cisco,
  Title                    = {{Cisco Application Visibility and Control (AVC)}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {https://www.cisco.com/c/en/us/products/routers/avc-control.html},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@Online{CiscoSystems--Network,
  Title                    = {{Network Based Application Recognition (NBAR)}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {https://www.cisco.com/c/en/us/products/ios-nx-os-software/network-based-application-recognition-nbar/index.html},
  Urldate                  = {2018-03-02},

  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@Online{CiscoSystems-2017-Cisco,
  Title                    = {{Cisco Visual Networking Index: Forecast and Methodology, 2016–2021}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {https://www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-vni/complete-white-paper-c11-481360.pdf},
  Urldate                  = {2018-03-02},

  Month                    = jun,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@Online{CiscoSystems-2013-Cisco,
  Title                    = {{Cisco IOS Flexible NetFlow Command Reference}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {http://www.cisco.com/c/en/us/td/docs/ios/fnetflow/command/reference/fnf_book/fnf_01.html},
  Urldate                  = {2017-06-21},

  Month                    = nov,
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2017.06.21}
}

@Online{CiscoSystems--NBAR2,
  Title                    = {{NBAR2 Protocol Library}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/network-based-application-recognition-nbar/product_bulletin_c25-627831.html},
  Urldate                  = {2017-09-27},

  Month                    = Jun,
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@Online{CiscoSystems-2008-Cisco,
  Title                    = {{Cisco IOS Flexible NetFlow}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/flexible-netflow/product_data_sheet0900aecd804b590b.html},
  Urldate                  = {2017-04-27},

  Month                    = dec,
  Year                     = {2008},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{CiscoSystems-2007-NetFlow,
  Title                    = {{NetFlow Services Solutions Guide}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html},
  Urldate                  = {2017-04-27},

  Month                    = jan,
  Year                     = {2007},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{CiscoSystems-2005-Cisco,
  Title                    = {{Cisco IOS NetFlow and Security}},
  Author                   = {{Cisco Systems, Inc., San Jose, CA and USA}},
  Url                      = {http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_presentation0900aecd80311f49.pdf},
  Urldate                  = {2017-04-27},

  Month                    = feb,
  Year                     = {2005},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Article{Claffy-2011-Tracking,
  Title                    = {{Tracking IPv6 Evolution: Data We Have and Data We Need}},
  Author                   = {Claffy, Kimberly C.},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2011},

  Month                    = jul,
  Number                   = {3},
  Pages                    = {43--48},
  Volume                   = {41},

  Acmid                    = {2002258},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/2002250.2002258},
  ISSN                     = {0146-4833},
  Issue_date               = {July 2011},
  Keywords                 = {active measurement, internet measurement techniques, network, validation},
  Numpages                 = {6},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.10.25},
  Url                      = {http://doi.acm.org/10.1145/2002250.2002258}
}

@Article{Claffy-1995-Parameterizable,
  Title                    = {{A Parameterizable Methodology for Internet Traffic Flow Profiling}},
  Author                   = {Claffy, Kimberly C. and Braun, Hans-Werner and Polyzos, George C.},
  Journal                  = {IEEE Journal on Selected Areas in Communications},
  Year                     = {1995},

  Month                    = Oct,
  Number                   = {8},
  Pages                    = {1481-1494},
  Volume                   = {13},

  Doi                      = {10.1109/49.464717},
  ISSN                     = {0733-8716},
  Keywords                 = {Internet;asynchronous transfer mode;performance evaluation;telecommunication services;telecommunication traffic;transport protocols;ATM fabric;IP traffic;Internet model;Internet traffic flow profiling;TCP connections;aggregate flow profile;application information;destination network;destination network flows;end-point definitions;host quadruple;host-pair;measurements;multiple service levels;networking;parameter space;parameterizable methodology;port quadruple;resource reservation;route caching;traffic flow granularities;usage based accounting;Aggregates;Fabrics;Helium;IP networks;Local area networks;Optimization methods;Telecommunication traffic;Token networks;Traffic control;Web and internet services},
  Owner                    = {velan},
  Timestamp                = {2017.04.28}
}

@Online{l7-filter,
  Title                    = {{l7-filter}},
  Author                   = {ClearFoundation},
  Url                      = {http://l7-filter.clearfoundation.com/},
  Urldate                  = {2014-11-26},

  Month                    = Oct,
  Year                     = {2013},

  Owner                    = {Milan},
  Timestamp                = {2014.12.01}
}

@Online{Codenomicon-2014-Heartbleed,
  Title                    = {{Heartbleed}},
  Author                   = {{Codenomicon}},
  Url                      = {http://heartbleed.com/},
  Urldate                  = {2014-11-25},

  Month                    = apr,
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2014.11.25}
}

@Article{Crovella-1997-Self,
  Title                    = {{Self-similarity in World Wide Web traffic: evidence and possible causes}},
  Author                   = {Crovella, Mark E. and Bestavros, Azer},
  Journal                  = {Networking, IEEE/ACM Transactions on},
  Year                     = {1997},

  Month                    = dec,
  Number                   = {6},
  Pages                    = {835-846},
  Volume                   = {5},

  Abstract                 = {The notion of self-similarity has been shown to apply to wide-area and local-area network traffic. We show evidence that the subset of network traffic that is due to World Wide Web (WWW) transfers can show characteristics that are consistent with self-similarity, and we present a hypothesized explanation for that self-similarity. Using a set of traces of actual user executions of NCSA Mosaic, we examine the dependence structure of WWW traffic. First, we show evidence that WWW traffic exhibits behavior that is consistent with self-similar traffic models. Then we show that the self-similarity in such traffic can be explained based on the underlying distributions of WWW document sizes, the effects of caching and user preference in file transfer, the effect of user “think time”, and the superimposition of many such transfers in a local-area network. To do this, we rely on empirically measured distributions both from client traces and from data independently collected at WWW servers},
  Doi                      = {10.1109/90.650143},
  ISSN                     = {1063-6692},
  Keywords                 = {Internet;local area networks;performance evaluation;statistical analysis;telecommunication traffic;wide area networks;LAN traffic;NCSA Mosaic;WAN traffic;WWW document size distribution;WWW servers;WWW traffic;World Wide Web traffic;caching;client traces;dependence structure;empirically measured distributions;file transfer;local-area network;self-similar traffic models;self-similarity;statistical tests;user preference;user think time;wide-area network;Intelligent networks;Internet;Local area networks;Network servers;Tail;Telecommunication traffic;Traffic control;Web server;Web sites;World Wide Web},
  Owner                    = {velan},
  Timestamp                = {2015.08.05}
}

@InProceedings{Cui-2007-Discoverer,
  Title                    = {{Discoverer: Automatic Protocol Reverse Engineering from Network Traces}},
  Author                   = {Cui, Weidong and Kannan, Jayanthkumar and Wang, Helen J.},
  Booktitle                = {Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium},
  Year                     = {2007},

  Address                  = {Berkeley, CA, USA},
  Pages                    = {14:1--14:14},
  Publisher                = {USENIX Association},
  Series                   = {SS'07},

  Acmid                    = {1362917},
  Articleno                = {14},
  ISBN                     = {111-333-5555-77-9},
  Location                 = {Boston, MA},
  Numpages                 = {14},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://dl.acm.org/citation.cfm?id=1362903.1362917}
}

@Article{Dainotti-2012-Issues,
  Title                    = {{Issues and Future Directions in Traffic Classification}},
  Author                   = {Dainotti, Alberto and Pescape, Antonio and Claffy, Kimberly C.},
  Journal                  = {Network, IEEE},
  Year                     = {2012},

  Month                    = Jan,
  Number                   = {1},
  Pages                    = {35-40},
  Volume                   = {26},

  Abstract                 = {Traffic classification technology has increased in relevance this decade, as it is now used in the definition and implementation of mechanisms for service differentiation, network design and engineering, security, accounting, advertising, and research. Over the past 10 years the research community and the networking industry have investigated, proposed and developed several classification approaches. While traffic classification techniques are improving in accuracy and efficiency, the continued proliferation of different Internet application behaviors, in addition to growing incentives to disguise some applications to avoid filtering or blocking, are among the reasons that traffic classification remains one of many open problems in Internet research. In this article we review recent achievements and discuss future directions in traffic classification, along with their trade-offs in applicability, reliability, and privacy. We outline the persistently unsolved challenges in the field over the last decade, and suggest several strategies for tackling these challenges to promote progress in the science of Internet traffic classification.},
  Doi                      = {10.1109/MNET.2012.6135854},
  ISSN                     = {0890-8044},
  Keywords                 = {Internet;computer network security;pattern classification;telecommunication network reliability;telecommunication traffic;Internet;network design;privacy;reliability;security;service differentiation;traffic classification;Classification algorithms;Feature extraction;Internet;Machine learning;Payloads;Telecommunication traffic},
  Owner                    = {velan},
  Review                   = {The article describes in general current state of the traffic classification research and shows areas that need further efforts. The authors also provide list of available implementations for traffic classification. They state that there is a strong need for more standardised evaluation of different techniques and approaches. Computational complexity of the algorithms and therefore further scalability is often of an issue.},
  Timestamp                = {2014.08.22}
}

@Online{Davids-2017-Initial,
  Title                    = {{Initial TTL values}},
  Author                   = {Davids, Noah},
  Url                      = {http://noahdavids.org/self_published/TTL_values.html},
  Urldate                  = {2017-10-25},

  Month                    = apr,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InProceedings{Davidson-2009-Protocol,
  Title                    = {{Protocol Normalization Using Attribute Grammars}},
  Author                   = {Davidson, Drew and Smith, Randy and Doyle, Nic and Jha, Somesh},
  Booktitle                = {Proceedings of the 14th European Conference on Research in Computer Security},
  Year                     = {2009},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {216--231},
  Publisher                = {Springer-Verlag},
  Series                   = {ESORICS'09},

  Acmid                    = {1813103},
  ISBN                     = {978-3-642-04443-4},
  Location                 = {Saint-Malo, France},
  Numpages                 = {16},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://dl.acm.org/citation.cfm?id=1813084.1813103}
}

@Article{DeMontigny-Leboeuf-2005-Flow,
  Title                    = {{Flow attributes for use in traffic characterization}},
  Author                   = {De Montigny-Leboeuf, Annie},
  Journal                  = {Communications Research Centre Canada, Tech. Rep},
  Year                     = {2005},

  Abstract                 = {Attackers disguise their activities in order to evade detection and circumvent network security measures. The work presented in this document builds upon earlier work on traffic profiling to reveal the nature of a flow based on its behaviour. An important step, which is the focus of the document, consists of identifying relevant and discriminative flow attributes for use in traffic characterization. We have developed a number of indicators that portray essential communication dynamics, based solely on information that can be gathered from monitoring packet headers. The indicators are lightweight and the characteristics measured can be interpreted from domain knowledge. A tool is under development at the Communications Research Centre Canada to demonstrate the relevance of the flow attributes in characterizing network traffic. In particular, the tool includes the capability to describe the traffic and recognize a number of ubiquitous protocols. Several of the protocols we experimented with are in essence very similar, but were found to be distinguishable with the indicators presented herein. Preliminary assessment shows us that the derived tool is useful as is, and may lead with further research to a number of applications.},
  Owner                    = {velan},
  Review                   = {Authors provide list of flow features that can be used for traffic classification. They also suggest methods to recognize applications such as SSH and HTTPS.},
  Timestamp                = {2014.10.17}
}

@InProceedings{Degioanni-2003-Profiling,
  Title                    = {{Profiling and Optimization of Software-Based Network-Analysis Applications}},
  Author                   = {Degioanni, Loris and Baldi, Mario and Risso, Fulvio and Varenni, Gianluca},
  Booktitle                = {Proceedings of the 15th Symposium on Computer Architecture and High Performance Computing},
  Year                     = {2003},

  Address                  = {Washington, DC, USA},
  Pages                    = {226--},
  Publisher                = {IEEE Computer Society},
  Series                   = {SBAC-PAD '03},

  Acmid                    = {952441},
  ISBN                     = {0-7695-2046-4},
  Owner                    = {velan},
  Timestamp                = {2018.02.10},
  Url                      = {http://dl.acm.org/citation.cfm?id=951954.952441}
}

@InProceedings{Degioanni-2004-Introducing,
  Title                    = {{Introducing Scalability in Network Measurement: Toward 10 Gbps with Commodity Hardware}},
  Author                   = {Degioanni, Loris and Varenni, Gianluca},
  Booktitle                = {Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2004},

  Address                  = {New York, NY, USA},
  Pages                    = {233--238},
  Publisher                = {ACM},
  Series                   = {IMC '04},

  Acmid                    = {1028818},
  Doi                      = {10.1145/1028788.1028818},
  ISBN                     = {1-58113-821-0},
  Keywords                 = {high performance, scalability, software tools},
  Location                 = {Taormina, Sicily, Italy},
  Numpages                 = {6},
  Owner                    = {velan},
  Timestamp                = {2018.02.10},
  Url                      = {http://doi.acm.org/10.1145/1028788.1028818}
}

@InProceedings{Deri-2005-nCap,
  Title                    = {{nCap: Wire-speed Packet Capture and Transmission}},
  Author                   = {Deri, Luca},
  Booktitle                = {Workshop on End-to-End Monitoring Techniques and Services, 2005.},
  Year                     = {2005},
  Month                    = may,
  Pages                    = {47-55},

  Doi                      = {10.1109/E2EMON.2005.1564468},
  Keywords                 = {computer networks;operating systems (computers);general-purpose operating systems;high-speed network monitoring;wire-speed packet capture;Computer networks;Computerized monitoring;Hardware;High-speed networks;Kernel;Linux;Manufacturing;Operating systems;Sockets;Software performance},
  Owner                    = {velan},
  Timestamp                = {2018.02.12}
}

@InProceedings{Deri-2004-Improving,
  Title                    = {{Improving Passive Packet Capture: Beyond Device Polling}},
  Author                   = {Deri, Luca},
  Booktitle                = {Proceedings of SANE},
  Year                     = {2004},
  Organization             = {Amsterdam, Netherlands},
  Pages                    = {85--93},
  Volume                   = {2004},

  Owner                    = {velan},
  Timestamp                = {2018.02.10}
}

@InProceedings{Deri-2003-nProbe,
  Title                    = {{nProbe: an Open Source NetFlow Probe for Gigabit Networks}},
  Author                   = {Deri, Luca},
  Booktitle                = {Proceedings of the TERENA Networking Conference, TNC'03},
  Year                     = {2003},

  Address                  = {Zagreb, Croatia},

  Owner                    = {velan},
  Timestamp                = {2017.09.27},
  Url                      = {http://luca.ntop.org/nProbe.pdf}
}

@InProceedings{Deri-2003-Passively,
  Title                    = {{Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software}},
  Author                   = {Deri, Luca},
  Booktitle                = {Proceedings of the Passive and Active Measurement Conference},
  Year                     = {2003},
  Pages                    = {1--7}
}

@InProceedings{Deri-2013-10,
  Title                    = {{10 Gbit Line Rate Packet-to-disk Using n2disk}},
  Author                   = {Deri, Luca and Cardigliano, Alfredo and Fusco, Francesco},
  Booktitle                = {Computer Communications Workshops (INFOCOM WKSHPS), 2013 IEEE Conference on},
  Year                     = {2013},
  Month                    = apr,
  Pages                    = {441-446},

  Abstract                 = {Capturing packets to disk at line rate and with high precision packet timestamping is required whenever an evidence of network communications has to be provided. Typical applications of long-term network traffic repositories are network troubleshooting, analysis of security violations, and analysis of high-frequency trading communications. Appliances for 10 Gbit packet capture to disk are often based on dedicated network adapters, and therefore very expensive, making them usable only in specific domains. This paper covers the design and implementation of n2disk, a packet capture to disk application, capable of dumping 10 Gbit traffic to disk using commodity hardware and open-source software. In addition to packet capture, n2disk is able to index the traffic at line-rate during capture, enabling users to efficiently search specific packets in network traffic dump files.},
  Doi                      = {10.1109/INFCOMW.2013.6562903},
  Keywords                 = {computer network security;public domain software;telecommunication traffic;commodity hardware;line rate packet-to-disk;n2disk;network adapter;network communication;network traffic dump file;network traffic repository;network troubleshooting;open-source software;packet capture to disk application;packet searching;packet timestamping;security violation;trading communication;traffic indexing;Band-pass filters;Indexing;Instruction sets;Matched filters;Monitoring;10 Gbit Traffic Monitoring;Packet Capture;Traffic Dump to Disk},
  Owner                    = {velan},
  Timestamp                = {2014.08.28}
}

@InProceedings{Deri-2014-nDPI,
  Title                    = {{nDPI: Open-source high-speed deep packet inspection}},
  Author                   = {Deri, Luca and Martinelli, Maurizio and Bujlow, Tomasz and Cardigliano, Alfredo},
  Booktitle                = {Wireless Communications and Mobile Computing Conference (IWCMC), 2014 International},
  Year                     = {2014},
  Month                    = Aug,
  Pages                    = {617-622},

  Abstract                 = {Network traffic analysis was traditionally limited to packet header, because the transport protocol and application ports were usually sufficient to identify the application protocol. With the advent of port-independent, peer-to-peer, and encrypted protocols, the task of identifying application protocols became increasingly challenging, thus creating a motivation for creating tools and libraries for network protocol classification. This paper covers the design and implementation of nDPI, an open-source library for protocol classification using both packet header and payload. nDPI was extensively validated in various monitoring projects ranging from Linux kernel protocol classification, to analysis of 10 Gbit traffic, reporting both high protocol detection accuracy and efficiency.},
  Doi                      = {10.1109/IWCMC.2014.6906427},
  Keywords                 = {ndpi},
  Location                 = {Nicosia, Cyprus},
  Owner                    = {Milan},
  Timestamp                = {2014.12.01}
}

@InProceedings{Dolberg-2012-Efficient,
  Title                    = {{Efficient Multidimensional Aggregation for Large Scale Monitoring}},
  Author                   = {Dolberg, Lautaro and Fran\c{c}ois, J{\'e}r\^{o}me and Engel, Thomas},
  Booktitle                = {Proceedings of the 26th International Conference on Large Installation System Administration: Strategies, Tools, and Techniques},
  Year                     = {2012},

  Address                  = {Berkeley, CA, USA},
  Pages                    = {163--180},
  Publisher                = {USENIX Association},
  Series                   = {lisa'12},

  Acmid                    = {2432537},
  Location                 = {San Diego, CA},
  Numpages                 = {18},
  Owner                    = {velan},
  Timestamp                = {2015.07.30}
}

@Article{Du-2013-Design,
  Title                    = {{Design of a Method for Encrypted P2P Traffic Identification Using K-means Algorithm}},
  Author                   = {Du, Ye and Zhang, Ruhui},
  Journal                  = {Telecommunication Systems},
  Year                     = {2013},
  Number                   = {1},
  Pages                    = {163-168},
  Volume                   = {53},

  Abstract                 = {Peer-to-Peer (P2P) plays an important role in the domain of Internet application, such as file sharing and instance communication. However, for the characteristic of bandwidth-intensive, P2P traffic identification is especially important in network management, which has been a hot topic in recent years. Based on the review of shortages of current existed technologies, a k-means algorithm based method was brought forward to identify the P2P traffic. For the reason that K-Means is one of the quickest and simplest clustering methods, it was selected as the core algorithm. In addition, the process of flow-information extraction and the descriptions of selected traffic attribute were also introduced in detail. Since the BT file-sharing traffic mainly runs over TCP, we only extract the flow-information of TCP connections. Finally, the experiments on 3 common used P2P applications, which are BitTorrent, BitSpirit and eMule, demonstrated the validity and efficiency of the method.},
  Doi                      = {10.1007/s11235-013-9690-5},
  ISSN                     = {1018-4864},
  Keywords                 = {K-means; P2P; Traffic Identification; Flow-information extraction},
  Language                 = {English},
  Owner                    = {velan},
  Publisher                = {Springer US},
  Review                   = {The authors manually analyze and extract distinct features of P2P traffic for k-means based classification algorithm. Paper-specific data set was created for feature extraction. Authors claim that the detection is accurate at the beginning of the connections thus allowing administrators to take actions. However, the described method seems to be using flows with 90s timeouts. The paper uses term Deep Flow Inspection for flow-based behavioral analysis.},
  Timestamp                = {2014.07.09},
  Url                      = {http://dx.doi.org/10.1007/s11235-013-9690-5}
}

@InProceedings{Durumeric-2013-Analysis,
  Title                    = {{Analysis of the HTTPS Certificate Ecosystem}},
  Author                   = {Durumeric, Zakir and Kasten, James and Bailey, Michael and Halderman, J. Alex},
  Booktitle                = {Proceedings of the 2013 Conference on Internet Measurement Conference},
  Year                     = {2013},

  Address                  = {New York, NY, USA},
  Pages                    = {291--304},
  Publisher                = {ACM},
  Series                   = {IMC '13},

  Abstract                 = {We report the results of a large-scale measurement study of the HTTPS certificate ecosystem---the public-key infrastructure that underlies nearly all secure web communications. Using data collected by performing 110 Internet-wide scans over 14 months, we gain detailed and temporally fine-grained visibility into this otherwise opaque area of security-critical infrastructure. We investigate the trust relationships among root authorities, intermediate authorities, and the leaf certificates used by web servers, ultimately identifying and classifying more than 1,800 entities that are able to issue certificates vouching for the identity of any website. We uncover practices that may put the security of the ecosystem at risk, and we identify frequent configuration problems that lead to user-facing errors and potential vulnerabilities. We conclude with lessons and recommendations to ensure the long-term health and security of the certificate ecosystem.},
  Acmid                    = {2504755},
  Doi                      = {10.1145/2504730.2504755},
  ISBN                     = {978-1-4503-1953-9},
  Keywords                 = {HTTPS, SSL, TLS, certificates, internet-wide scanning, measurement, public-key infrastructure, security, x.509},
  Location                 = {Barcelona, Spain},
  Numpages                 = {14},
  Owner                    = {velan},
  Review                   = {Authors use periodical active probing of IPv4 address space to find machines willing to complete TLS handshake on port 443. The gather massive amount of certificates and provide very detailed analysis of used CAs, intermediate certificates and quality of issued certificates. The data sets should be publicly available.},
  Timestamp                = {2014.06.16},
  Url                      = {http://doi.acm.org/10.1145/2504730.2504755}
}

@InProceedings{Elich-2011-Monitoring,
  Title                    = {{Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX}},
  Author                   = {Elich, Martin and Grégr, Matěj and Čeleda, Pavel},
  Booktitle                = {Proceedings of the Third International Conference on Traffic Monitoring and Analysis},
  Year                     = {2011},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {64--71},
  Publisher                = {Springer-Verlag},
  Series                   = {TMA'11},

  Acmid                    = {1986290},
  ISBN                     = {978-3-642-20304-6},
  Keywords                 = {6to4, FlowMon, IPFIX, IPv6, IPv6 tunnel, ISATAP, Teredo, network monitoring},
  Location                 = {Vienna, Austria},
  Numpages                 = {8},
  Owner                    = {velan},
  Timestamp                = {2017.10.25},
  Url                      = {http://dl.acm.org/citation.cfm?id=1986282.1986290}
}

@Online{Elich-2013-FlowMon,
  Title                    = {{FlowMon IPv6 Tunnel Monitoring Plugin}},
  Author                   = {Elich, Martin and Velan, Petr and Čeleda, Pavel},
  Url                      = {http://dior.ics.muni.cz/~velan/flowmon-input-ip6tun/},
  Urldate                  = {2017-10-25},

  Month                    = may,
  Year                     = {2013}
}

@InProceedings{Elich-2013-Investigation,
  Title                    = {{An Investigation Into Teredo and 6to4 Transition Mechanisms: Traffic Analysis}},
  Author                   = {Elich, Martin and Velan, Petr and Jirsík, Tomáš and Čeleda, Pavel},
  Booktitle                = {IEEE 38th Conference on Local Computer Networks Workshops (LCN Workshops)},
  Year                     = {2013},

  Address                  = {Sydney, Australia},
  Editor                   = {Damla Turgut, Nils Aschenbruck, Jens T\"{o}lle},
  Month                    = Oct,
  Pages                    = {1046-1052},
  Publisher                = {IEEE Xplore Digital Library},

  Abstract                 = {The exhaustion of IPv4 address space increases pressure on network operators and content providers to continue the transition to IPv6. The IPv6 transition mechanisms such as Teredo and 6to4 allow IPv4 hosts to connect to IPv6 hosts. On the othe
r hand, they increase network complexity and render ineffective many methods to observe IP traffic. In this paper, we modified our flow-based measurement system to involve transition mechanisms information to provide full IPv6 visibility. Our traffic analysis focuses on IPv
6 tunneled traffic and uses data collected over one week in the Czech national research and education network. The results expose various traffic characteristics of native and tunneled IPv6 traffic, among others the TTL and HOP limit distribution, geolocation aspect of the 
traffic, and list of Teredo servers used in the network. Furthermore, we show how the traffic of IPv6 transition mechanisms has evolved since 2010.},
  Doi                      = {10.1109/LCNW.2013.6758546},
  ISBN                     = {978-1-4799-0540-9},
  Keywords                 = {Teredo; 6to4; IPv6; Transition Mechanisms},
  Location                 = {Sydney, Australia},
  Owner                    = {velan},
  Timestamp                = {2014.08.23},
  Url                      = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6758546}
}

@Online{ESCERTNSAGET--yaf,
  Title                    = {{yaf deep packet inspection}},
  Author                   = {{Emily Sarneso and the CERT Network Situational Awareness Group Engineering Team}},
  Url                      = {https://tools.netsa.cert.org/yaf/yafdpi.html},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@Online{ETL--Endace,
  Title                    = {{Endace Homepage}},
  Author                   = {{Endace Technology Limited}},
  Url                      = {https://www.endace.com/},
  Urldate                  = {2018-02-10},

  Owner                    = {velan},
  Timestamp                = {2018.02.10}
}

@InProceedings{Eriksson-2010-Learning,
  Title                    = {{A Learning-Based Approach for IP Geolocation}},
  Author                   = {Eriksson, Brian and Barford, Paul and Sommers, Joel and Nowak, Robert},
  Booktitle                = {Proceedings of the 11th International Conference on Passive and Active Measurement (PAM)},
  Year                     = {2010},
  Pages                    = {171-180},
  Series                   = {Lecture Notes in Computer Science},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Article{Estan-2004-Building,
  Title                    = {{Building a Better NetFlow}},
  Author                   = {Estan, Cristian and Keys, Ken and Moore, David and Varghese, George},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2004},

  Month                    = aug,
  Number                   = {4},
  Pages                    = {245--256},
  Volume                   = {34},

  Acmid                    = {1015495},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/1030194.1015495},
  ISSN                     = {0146-4833},
  Issue_date               = {October 2004},
  Keywords                 = {data summarization, network monitoring, traffic measurement},
  Numpages                 = {12},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.06.02},
  Url                      = {http://doi.acm.org/10.1145/1030194.1015495}
}

@InProceedings{Felt-2017-Measuring,
  Title                    = {{Measuring HTTPS Adoption on the Web}},
  Author                   = {Felt, Adrienne Porter and Barnes, Richard and King, April and Palmer, Chris and Bentzel, Chris and Tabriz, Parisa},
  Booktitle                = {26th USENIX Security Symposium},
  Year                     = {2017},
  Pages                    = {1323--1338},

  Owner                    = {velan},
  Timestamp                = {2018.02.20}
}

@Misc{draft-irtf-nmrg-location-ipfix-00,
  Title                    = {{Information Elements for device location in IPFIX}},

  Author                   = {Olivier Festor and Abdelkader Lahmadi},
  HowPublished             = {Internet-Draft},
  Month                    = jul,
  Year                     = {2012},

  Owner                    = {velan},
  Publisher                = {{IETF}},
  Timestamp                = {2017.10.25}
}

@Article{Finsterbusch-2014-Survey,
  Title                    = {{A Survey of Payload-Based Traffic Classification Approaches}},
  Author                   = {Finsterbusch, Michael and Richter, Chris and Rocha, Eduardo and Muller, Jean-Alexander and Hanssgen, Klaus},
  Journal                  = {Communications Surveys \& Tutorials, IEEE},
  Year                     = {2014},

  Month                    = May,
  Number                   = {2},
  Pages                    = {1135-1156},
  Volume                   = {16},

  Abstract                 = {Internet traffic classification has been the subject of intensive study since the birth of the Internet itself. Indeed, the evolution of approaches for traffic classification can be associated with the evolution of the Internet itself and with the adoption of new services and the emergence of novel applications and communication paradigms. Throughout the years many approaches have been proposed for addressing technical issues imposed by such novel services. Deep-Packet Inspection (DPI) has been a very important research topic within the traffic classification field and its concept consists of the analysis of the contents of the captured packets in order to accurately and timely discriminate the traffic generated by different Internet protocols. DPI was devised as a means to address several issues associated with port-based and statistical-based classification approaches in order to achieve an accurate and timely traffic classification. Many research works proposed different DPI schemes while many open-source modules have also become available for deployment. Surveys become then valuable tools for performing an overall analysis, study and comparison between the several proposed methods. In this paper we present a survey in which a complete and thorough analysis of the most important open-source DPI modules is performed. Such analysis comprises an evaluation of the classification accuracy, through a common set of traffic traces with ground truth, and of the computational requirements. In this manner, this survey presents a technical assessment of DPI modules and the analysis of the obtained evaluation results enable the proposal of general guidelines for the design and implementation of more adequate DPI modules.},
  Doi                      = {10.1109/SURV.2013.100613.00161},
  ISSN                     = {1553-877X},
  Keywords                 = {Internet;pattern classification;telecommunication traffic;DPI schemes;Internet protocols;Internet traffic classification;deep-packet inspection;open-source DPI modules;payload-based traffic classification approach;port-based classification approach;statistical-based classification approach;Accuracy;Algorithm design and analysis;Internet;Machine learning algorithms;Ports (Computers);Protocols;Vectors;Internet traffic identification;Open source software;Performance evaluation},
  Owner                    = {velan},
  Review                   = {Authors perform an extensive survey of packet-based traffic classification approaches. In total, they recognize four categories of traffic classification: port-based approach, statistical approach, pattern-matching and protocol decoding. Related work section describes all categories, although authors work with packet-based classification in the rest of the paper. Authors also differentiate encrypted traffic by the used encryption into following types: encryption after handshake, encryption of the payload, encryption of parts of the header and the whole payload, encryption of the whole flow.

The core of the paper is an evaluation and discussion of existing open-source DPI classifiers. The discussion involves ground truth, flows vs. packets, processing of TCP flows, encrypted traffic and design of traffic classifiers in general.},
  Timestamp                = {2014.10.23}
}

@Online{FlowmonNetworks--Flowmon,
  Title                    = {{Flowmon Probe}},
  Author                   = {{Flowmon Networks}},
  Url                      = {https://www.flowmon.com/en/products/flowmon/probe},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@InProceedings{Fomenkov-2004-Longitudinal,
  Title                    = {{Longitudinal Study of Internet Traffic in 1998-2003}},
  Author                   = {Fomenkov, Marina and Keys, Ken and Moore, David and Claffy, K},
  Booktitle                = {Proceedings of the Winter International Synposium on Information and Communication Technologies},
  Year                     = {2004},
  Pages                    = {1--6},
  Publisher                = {Trinity College Dublin},
  Series                   = {WISICT '04},

  Abstract                 = {There is growing interest in capturing and analyzing Internet traffic characteristics in pursuit of insights into its evolution. We present a study of one of the few sources of publicly available long-term Internet traffic workload data, namely the NLANR PMA archive of packet header traces. Trace samples were collected at a number of academic, research, and commercial sites during years 1998--2003. We consider four metrics of traffic: bytes, packets, flows, and number of source-destination pairs. We also analyze the composition of traffic by protocol.},
  Acmid                    = {984747},
  Keywords                 = {Internet traffic workload characterization, TCP, UDP, flows, traffic scaling},
  Location                 = {Cancun, Mexico},
  Numpages                 = {6},
  Owner                    = {velan},
  Timestamp                = {2015.07.27}
}

@Article{Fraleigh-2003-Packet,
  Title                    = {{Packet-level traffic measurements from the Sprint IP backbone}},
  Author                   = {Fraleigh, Chuck and Moon, Sue and Lyles, Bryan and Cotton, Chase and Khan, Mujahid and Moll, Deb and Rockell, Rob and Seely, Ted and Diot, Sprint Christophe},
  Journal                  = {Network, IEEE},
  Year                     = {2003},

  Month                    = nov,
  Number                   = {6},
  Pages                    = {6-16},
  Volume                   = {17},

  Abstract                 = {Network traffic measurements provide essential data for networking research and network management. In this article we describe a passive monitoring system designed to capture GPS synchronized packet-level traffic measurements on OC-3, OC-12, and OC-48 links. Our system is deployed in four POP in the Sprint IP backbone. Measurement data is stored on a 10 Tbyte storage area network and analyzed on a computing cluster. We present a set of results to both demonstrate the strength of the system and identify recent changes in Internet traffic characteristics. The results include traffic workload, analyses of TCP flow round-trip times, out-of-sequence packet rates, and packet delay. We also show that some links no longer carry Web traffic as their dominant component to the benefit of file sharing and media streaming. On most links we monitored, TCP flows exhibit low out-of-sequence packet rates, and backbone delays are dominated by the speed of light.},
  Doi                      = {10.1109/MNET.2003.1248656},
  ISSN                     = {0890-8044},
  Keywords                 = {Internet;delays;monitoring;multimedia communication;packet switching;telecommunication traffic recording;transport protocols;GPS synchronized measurements;Internet traffic characteristics;OC-12;OC-3;OC-48 links;POP;Sprint IP backbone;TCP flow round-trip times;Web traffic;backbone delays;file sharing;media streaming;network management;network traffic measurements;out-of-sequence packet rates;packet delay;packet-level traffic measurements;passive monitoring system;traffic workload;Area measurement;Computer networks;Delay;Global Positioning System;Internet;Monitoring;Spine;Storage area networks;Streaming media;Telecommunication traffic},
  Owner                    = {velan},
  Timestamp                = {2015.07.27}
}

@TechReport{SP-800-77,
  Title                    = {{SP 800-77. Guide to IPsec VPNs}},
  Author                   = {Frankel, Sheila and Kent, Karen and Lewkowski, Ryan and Orebaugh, Angela D. and Ritchey, Ronald W. and Sharma, Steven R.},
  Institution              = {National Institute of Standards \& Technology},
  Year                     = {2005},

  Address                  = {Gaithersburg, MD, United States},

  Keywords                 = {IPSec; VPN; Authentication Header; Encapsulating Security Payload; Internet Key Exchange},
  Owner                    = {Milan},
  Review                   = {Very good introduction to the topic with sufficient description of all important thinks. because the paper age, the informations about IKE are outdated (now is used IKEv2 with significant changes).},
  Timestamp                = {2014.10.07},
  Url                      = {http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf}
}

@InProceedings{Fusco-2010-High,
  Title                    = {{High Speed Network Traffic Analysis with Commodity Multi-core Systems}},
  Author                   = {Fusco, Francesco and Deri, Luca},
  Booktitle                = {Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2010},

  Address                  = {New York, NY, USA},
  Pages                    = {218--224},
  Publisher                = {ACM},
  Series                   = {IMC '10},

  Acmid                    = {1879169},
  Doi                      = {10.1145/1879141.1879169},
  ISBN                     = {978-1-4503-0483-2},
  Keywords                 = {linux kernel, multi-core systems, network packet capture},
  Location                 = {Melbourne, Australia},
  Numpages                 = {7},
  Owner                    = {velan},
  Timestamp                = {2018.02.12},
  Url                      = {http://doi.acm.org/10.1145/1879141.1879169}
}

@Misc{sftp-draft,
  Title                    = {{SSH File Transfer Protocol draft-ietf-secsh-filexfer-13.txt}},

  Author                   = {Galbraith, J. and Saarenmaa, O.},
  HowPublished             = {Internet-Draft},
  Month                    = Jul,
  Year                     = {2006},

  Abstract                 = {The SSH File Transfer Protocol provides secure file transfer functionality over any reliable, bidirectional octect stream. It is the standard file transfer protocol for use with the SSH2 protocol. This document describes the file transfer protocol and its interface to the SSH2 protocol suite.},
  Keywords                 = {SFTP, SSH, draft},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03},
  Url                      = {https://tools.ietf.org/html/draft-ietf-secsh-filexfer-13}
}

@InProceedings{Gallenmueller-2015-Comparison,
  Title                    = {{Comparison of Frameworks for High-Performance Packet IO}},
  Author                   = {Gallenm\"{u}ller, Sebastian and Emmerich, Paul and Wohlfart, Florian and Raumer, Daniel and Carle, Georg},
  Booktitle                = {Proceedings of the Eleventh ACM/IEEE Symposium on Architectures for Networking and Communications Systems},
  Year                     = {2015},

  Address                  = {Washington, DC, USA},
  Pages                    = {29--38},
  Publisher                = {IEEE Computer Society},
  Series                   = {ANCS '15},

  Acmid                    = {2772729},
  ISBN                     = {978-1-4673-6632-8},
  Keywords                 = {dpdk, netmap, performance measurement, pf_ring zc, software packet processing},
  Location                 = {Oakland, California, USA},
  Numpages                 = {10},
  Owner                    = {velan},
  Timestamp                = {2018.02.09},
  Url                      = {http://dl.acm.org/citation.cfm?id=2772722.2772729}
}

@InProceedings{Gao-2006-Efficient,
  Title                    = {{Efficient packet matching for gigabit network intrusion detection using TCAMs}},
  Author                   = {Gao, Ming and Zhang, Kenong and Lu, Jiahua},
  Booktitle                = {Advanced Information Networking and Applications, 2006. AINA 2006. 20th International Conference on},
  Year                     = {2006},
  Pages                    = {1--6},
  Volume                   = {1},

  Doi                      = {10.1109/AINA.2006.164},
  ISSN                     = {1550-445X},
  Keywords                 = {content-addressable storage;field programmable gate arrays;pattern matching;search engines;security of data;telecommunication security;FPGA;TCAM;field programmable gate array;gigabit network intrusion detection system;header rules matching system;long pattern matching architecture;packet matching;range pattern matching;router;searching pattern;signature set based NIDS;ternary content-addressable memory;Engines;Ethernet networks;Field programmable gate arrays;Intrusion detection;Packaging;Pattern matching;Software performance;Spine;Systems engineering and theory;TCPIP},
  Owner                    = {velan},
  Timestamp                = {2017.08.24}
}

@Article{Garcia-Dorado-2012-Characterization,
  Title                    = {{Characterization of ISP Traffic: Trends, User Habits, and Access Technology Impact}},
  Author                   = {García-Dorado, José Luis and Finamore, Alessandro and Mellia, Marco and Meo, Michela and Munafo, Maurizio M.},
  Journal                  = {Network and Service Management, IEEE Transactions on},
  Year                     = {2012},

  Month                    = jun,
  Number                   = {2},
  Pages                    = {142-155},
  Volume                   = {9},

  Abstract                 = {In the recent years, the research community has increased its focus on network monitoring which is seen as a key tool to understand the Internet and the Internet users. Several studies have presented a deep characterization of a particular application, or a particular network, considering the point of view of either the ISP, or the Internet user. In this paper, we take a different perspective. We focus on three European countries where we have been collecting traffic for more than a year and a half through 5 vantage points with different access technologies. This humongous amount of information allows us not only to provide precise, multiple, and quantitative measurements of "What the user do with the Internet" in each country but also to identify common/uncommon patterns and habits across different countries and nations. Considering different time scales, we start presenting the trend of application popularity; then we focus our attention to a one-month long period, and further drill into a typical daily characterization of users activity. Results depict an evolving scenario due to the consolidation of new services as Video Streaming and File Hosting and to the adoption of new P2P technologies. Despite the heterogeneity of the users, some common tendencies emerge that can be leveraged by the ISPs to improve their service.},
  Doi                      = {10.1109/TNSM.2012.022412.110184},
  ISSN                     = {1932-4537},
  Keywords                 = {Internet;peer-to-peer computing;telecommunication traffic;video streaming;European countries;ISP traffic characterization;Internet users;P2P technologies;access technology impact;file hosting;network monitoring;user habits;video streaming;Availability;Bit rate;Internet;Monitoring;Optical fiber subscriber loops;Probes;Streaming media;ISP traffic;Network monitoring;traffic analyzer},
  Owner                    = {velan},
  Timestamp                = {2015.08.12}
}

@InCollection{Garcia-Dorado-2013-High,
  Title                    = {{High-Performance Network Traffic Processing Systems Using Commodity Hardware}},
  Author                   = {García-Dorado, José Luis and Mata, Felipe and Ramos, Javier and Santiago del Río, Pedro M. and Moreno, Victor and Aracil, Javier},
  Booktitle                = {Data Traffic Monitoring and Analysis},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2013},
  Editor                   = {Biersack, Ernst and Callegari, Christian and Matijasevic, Maja},
  Pages                    = {3-27},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {7754},

  Abstract                 = {The Internet has opened new avenues for information accessing and sharing in a variety of media formats. Such popularity has resulted in an increase of the amount of resources consumed in backbone links, whose capacities have witnessed numerous upgrades to cope with the ever-increasing demand for bandwidth. Consequently, network traffic processing at today’s data transmission rates is a very demanding task, which has been traditionally accomplished by means of specialized hardware tailored to specific tasks. However, such approaches lack either of flexibility or extensibility—or both. As an alternative, the research community has pointed to the utilization of commodity hardware, which may provide flexible and extensible cost-aware solutions, ergo entailing large reductions of the operational and capital expenditure investments. In this chapter, we provide a survey-like introduction to high-performance network traffic processing using commodity hardware. We present the required background to understand the different solutions proposed in the literature to achieve high-speed lossless packet capture, which are reviewed and compared.},
  Doi                      = {10.1007/978-3-642-36784-7_1},
  ISBN                     = {978-3-642-36783-0},
  Keywords                 = {commodity hardware; packet capture engine; high-performance networking; network traffic monitoring},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {This recent work provides overview of different commodity based packet capture solutions. The paper describes techniques used by various researches to achieve 10 G packet rates in detail. Authors explain features of current NICs, NUMA architecture, OS network stack as well as approaches to utilize these concepts and overcome performance bottlenecks.},
  Timestamp                = {2014.09.04},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-36784-7_1}
}

@InProceedings{Gehlen-2012-Uncovering,
  Title                    = {{Uncovering the Big Players of the Web}},
  Author                   = {Gehlen, Vinicius and Finamore, Alessandro and Mellia, Marco and Munaf\`{o}, Maurizio M.},
  Booktitle                = {Proceedings of the 4th international conference on Traffic Monitoring and Analysis},
  Year                     = {2012},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {15--28},
  Publisher                = {Springer-Verlag},
  Series                   = {TMA'12},

  Acmid                    = {2238859},
  Doi                      = {10.1007/978-3-642-28534-9_2},
  ISBN                     = {978-3-642-28533-2},
  Location                 = {Vienna, Austria},
  Numpages                 = {14},
  Owner                    = {velan},
  Timestamp                = {2017.10.18},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-28534-9_2}
}

@Online{--geoPlugin,
  Title                    = {{geoPlugin to geolocate your visitors}},
  Author                   = {{geoPlugin}},
  Url                      = {http://www.geoplugin.com},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Online{pace,
  Title                    = {{PACE 2.0}},
  Author                   = {ipoque GmbH},
  Url                      = {http://www.ipoque.com/en/products/pace},
  Urldate                  = {2014-11-25},

  Keywords                 = {PACE},
  Owner                    = {Milan},
  Timestamp                = {2014.12.01}
}

@Online{GNUProject-2017-GNU,
  Title                    = {{The GNU C Library (glibc)}},
  Author                   = {{GNU Project}},
  Url                      = {http://www.gnu.org/software/libc/},
  Urldate                  = {2017-10-18},

  Month                    = aug,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Online{Google--Verifying,
  Title                    = {{Verifying Googlebot}},
  Author                   = {Google},
  Url                      = {https://support.google.com/webmasters/answer/80553},
  Urldate                  = {2017-10-20},

  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{Google-2014-Poodle,
  Title                    = {{Poodle}},
  Author                   = {{Google}},
  Url                      = {https://www.openssl.org/~bodo/ssl-poodle.pdf},
  Urldate                  = {2014-11-25},

  Month                    = sep,
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2014.11.25}
}

@Book{Gormley-2015-Elasticsearch,
  Title                    = {{Elasticsearch: The Definitive Guide}},
  Author                   = {Gormley, Clinton and Tong, Zachary},
  Publisher                = {O'Reilly Media, Inc.},
  Year                     = {2015},
  Edition                  = {1st},

  ISBN                     = {978-1449358549},
  Owner                    = {velan},
  Timestamp                = {2017.08.03}
}

@Online{Gregg-2018-KPTIKAISER,
  Title                    = {{KPTI/KAISER Meltdown Initial Performance Regressions}},
  Author                   = {Gregg, Brendan},
  Url                      = {http://www.brendangregg.com/blog/2018-02-09/kpti-kaiser-meltdown-performance.html},
  Urldate                  = {2018-02-13},

  Month                    = feb,
  Year                     = {2018},

  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Online{Haag-2014-NFDUMP,
  Title                    = {{NFDUMP}},
  Author                   = {Haag, Peter},
  Url                      = {http://nfdump.sourceforge.net/},
  Urldate                  = {2017-08-03},

  Month                    = dec,
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2017.08.03}
}

@Online{Haag-2011-NfSen,
  Title                    = {{NfSen}},
  Author                   = {Haag, Peter},
  Url                      = {http://nfsen.sourceforge.net/},
  Urldate                  = {2017-08-04},

  Month                    = dec,
  Year                     = {2011},

  Owner                    = {velan},
  Timestamp                = {2017.08.04}
}

@InProceedings{Han-2010-PacketShader,
  Title                    = {{PacketShader: A GPU-accelerated Software Router}},
  Author                   = {Han, Sangjin and Jang, Keon and Park, KyoungSoo and Moon, Sue},
  Booktitle                = {Proceedings of the ACM SIGCOMM 2010 Conference},
  Year                     = {2010},

  Address                  = {New York, NY, USA},
  Pages                    = {195--206},
  Publisher                = {ACM},
  Series                   = {SIGCOMM '10},

  Acmid                    = {1851207},
  Doi                      = {10.1145/1851182.1851207},
  ISBN                     = {978-1-4503-0201-2},
  Keywords                 = {CUDA, GPU, software router},
  Location                 = {New Delhi, India},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.02.13},
  Url                      = {http://doi.acm.org/10.1145/1851182.1851207}
}

@Online{bittorrent-specification,
  Title                    = {{Index of BitTorrent Enhancement Proposals}},
  Author                   = {Harrison, David},
  Url                      = {http://www.bittorrent.org/beps/bep_0000.html},
  Urldate                  = {2014-11-27},

  Month                    = Oct,
  Year                     = {2014},

  Keywords                 = {bittorrent, specification},
  Owner                    = {Milan},
  Timestamp                = {2014.12.03}
}

@Online{Hazel-2015-PCRE,
  Title                    = {{PCRE -- Perl Compatible Regular Expressions}},
  Author                   = {Hazel, Philip},
  Url                      = {http://www.pcre.org/},
  Urldate                  = {2017-10-18},
  Year                     = {2015},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@InCollection{hellmons-2012-sshcure,
  Title                    = {{SSHCure: A Flow-Based SSH Intrusion Detection System}},
  Author                   = {Hellemons, Laurens and Hendriks, Luuk and Hofstede, Rick and Sperotto, Anna and Sadre, Ramin and Pras, Aiko},
  Booktitle                = {Dependable Networks and Services},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2012},
  Pages                    = {86-97},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {7279},

  Abstract                 = {SSH attacks are a main area of concern for network managers, due to the danger associated with a successful compromise. Detecting these attacks, and possibly compromised victims, is therefore a crucial activity. Most existing network intrusion detection systems designed for this purpose rely on the inspection of individual packets and, hence, do not scale to today’s high-speed networks. To overcome this issue, this paper proposes SSHCure, a flow-based intrusion detection system for SSH attacks. It employs an efficient algorithm for the real-time detection of ongoing attacks and allows identification of compromised attack targets. A prototype implementation of the algorithm, including a graphical user interface, is implemented as a plugin for the popular NfSen monitoring tool. Finally, the detection performance of the system is validated with empirical traffic data.},
  Doi                      = {10.1007/978-3-642-30633-4_11},
  Owner                    = {Milan},
  Timestamp                = {2014.12.01},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-30633-4_11}
}

@Misc{Hendriks-2016-Assessing,
  Title                    = {{Assessing the quality of flow measurements from OpenFlow devices}},

  Author                   = {Hendriks, Luuk and {de Oliveira Schmidt}, Ricardo and Sadre, Ramin and Bezerra, Jeronimo A. and Pras, Aiko},
  Month                    = {4},
  Year                     = {2016},

  Abstract                 = {Since its initial proposal in 2008, OpenFlow has evolved to become today’s main enabler of Software-Defined Networking. OpenFlow specifies operations for network forwarding devices and a communication protocol between data and control planes. Although not primarily designed as a traffic measurement tool, many works have proposed to use measured data from OpenFlow to support, e.g., traffic engineering or security in OpenFlow-enabled networks. These works, however, generally do not question or address the quality of actual measured data obtained from OpenFlow devices. Therefore, in this paper we assess the quality of measurements in real OpenFlow devices from multiple vendors. We demonstrate that inconsistencies and measurement artifacts can be found due to particularities of different OpenFlow implementations, making it impractical to deploy an OpenFlow measurement-based approach in a network consisting of devices from multiple vendors. In addition, we show that the accuracy of measured packet and byte counts and duration for flows vary among the tested devices, and in some cases counters are not even implemented for the sake of forwarding performance.},
  Keywords                 = {counters, EWI-27762, OpenFlow, Traffic measurements, IR-104409},
  Owner                    = {velan},
  Pages                    = {1--8},
  Timestamp                = {2018.01.19}
}

@InProceedings{Hendriks-2017-Flow,
  Title                    = {{Flow-Based Detection of IPv6-specific Network Layer Attacks}},
  Author                   = {Hendriks, Luuk and Velan, Petr and de Oliveira Schmidt, Ricardo and de Boer, Pieter-Tjerk and Pras, Aiko},
  Booktitle                = {Security of Networks and Services in an All-Connected World: 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017, Zurich, Switzerland, July 10-13, 2017, Proceedings},
  Year                     = {2017},

  Address                  = {Cham},
  Editor                   = {Tuncer, Daphne and Koch, Robert and Badonnel, R{\'e}mi and Stiller, Burkhard},
  Pages                    = {137--142},
  Publisher                = {Springer International Publishing},

  Abstract                 = {With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By constructing flow-based signatures, detection can be performed using available technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two production networks and injecting attacks into the production traffic.},
  Doi                      = {10.1007/978-3-319-60774-0_11},
  ISBN                     = {978-3-319-60774-0},
  Owner                    = {velan},
  Timestamp                = {2017.08.24},
  Url                      = {https://doi.org/10.1007/978-3-319-60774-0_11}
}

@InProceedings{Hendriks-2017-Threats,
  Title                    = {{Threats and Surprises behind IPv6 Extension Headers}},
  Author                   = {Hendriks, Luuk and Velan, Petr and de Oliveira Schmidt, Ricardo and de Boer, Pieter-Tjerk and Pras, Aiko},
  Booktitle                = {2017 Network Traffic Measurement and Analysis Conference (TMA)},
  Year                     = {2017},
  Month                    = Jun,
  Pages                    = {1--9},
  Publisher                = {IEEE Xplore Digital Library},

  Abstract                 = {The concept of Extension Headers, newly introduced with IPv6, is elusive and enables new types of threats in the Internet. Simply dropping all traffic containing any Extension Header — a current practice by operators-seemingly is an effective solution, but at the cost of possibly dropping legitimate traffic as well. To determine whether threats indeed occur, and evaluate the actual nature of the traffic, measurement solutions need to be adapted. By implementing these specific parsing capabilities in flow exporters and performing measurements on two different production networks, we show it is feasible to quantify the metrics directly related to these threats, and thus allow for monitoring and detection. Analysing the traffic that is hidden behind Extension Headers, we find mostly benign traffic that directly affects end-user QoE: simply dropping all traffic containing Extension Headers is thus a bad practice with more consequences than operators might be aware of.},
  Doi                      = {10.23919/TMA.2017.8002912},
  Keywords                 = {Internet;Monitoring;Payloads;Probes;Protocols;Security;Standards},
  Owner                    = {velan},
  Timestamp                = {2017.08.24}
}

@Online{Hofstede--SURFmap,
  Title                    = {{SURFmap: A Network Monitoring Tool Based on the Google Maps API}},
  Author                   = {Hofstede, Rick},
  Url                      = {http://surfmap.sourceforge.net/},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Article{Hofstede-2014-Flow,
  Title                    = {{Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX}},
  Author                   = {Hofstede, Rick and Čeleda, Pavel and Trammell, Brian and Drago, Idilio and Sadre, Ramin and Sperotto, Anna and Pras, Aiko},
  Journal                  = {Communications Surveys Tutorials, IEEE},
  Year                     = {2014},
  Number                   = {99},
  Pages                    = {2037--2064},
  Volume                   = {PP},

  Abstract                 = {Flow monitoring has become a prevalent method for monitoring traffic in high-speed networks. By focusing on the analysis of flows, rather than individual packets, it is often said to be more scalable than traditional packet-based traffic analysis. Flow monitoring embraces the complete chain of packet observation, flow export using protocols such as NetFlow and IPFIX, data collection, and data analysis. In contrast to what is often assumed, all stages of flow monitoring are closely intertwined. Each of these stages therefore has to be thoroughly understood, before being able to perform sound flow measurements. Otherwise, flow data artifacts and data loss can be the consequence, potentially without being observed. This paper is the first of its kind to provide an integrated tutorial on all stages of a flow monitoring setup. As shown throughout this paper, flow monitoring has evolved from the early nineties into a powerful tool, and additional functionality will certainly be added in the future. We show, for example, how the previously opposing approaches of Deep Packet Inspection and flow monitoring have been united into novel monitoring approaches.},
  Doi                      = {10.1109/COMST.2014.2321898},
  ISSN                     = {1553-877X},
  Keywords                 = {Data analysis;Electronic mail;Internet;Monitoring;Protocols;Standards;Tutorials},
  Owner                    = {velan},
  Review                   = {A recent survey of Hofstede et al. describes current state of flow monitoring systems including both open source and enterprise products.},
  Timestamp                = {2014.09.03}
}

@InProceedings{Hofstede-2011-Flow,
  Title                    = {{Flow Monitoring Experiences at the Ethernet-layer}},
  Author                   = {Hofstede, Rick and Drago, Idilio and Sperotto, Anna and Pras, Aiko},
  Booktitle                = {Proceedings of the 17th International Conference on Energy-aware Communications},
  Year                     = {2011},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {134--145},
  Publisher                = {Springer-Verlag},
  Series                   = {EUNICE'11},

  Acmid                    = {2040437},
  ISBN                     = {978-3-642-23540-5},
  Keywords                 = {IPFIX, carrier, ethernet, flow monitoring, network management},
  Location                 = {Dresden, Germany},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2017.04.27},
  Url                      = {http://dl.acm.org/citation.cfm?id=2040416.2040437}
}

@InProceedings{Hofstede-2013-Measurement,
  Title                    = {{Measurement Artifacts in NetFlow Data}},
  Author                   = {Hofstede, Rick and Drago, Idilio and Sperotto, Anna and Sadre, Ramin and Pras, Aiko},
  Booktitle                = {Passive and Active Measurement},
  Year                     = {2013},

  Address                  = {Berlin, Heidelberg},
  Editor                   = {Roughan, Matthew
and Chang, Rocky},
  Pages                    = {1--10},
  Publisher                = {Springer Berlin Heidelberg},

  Abstract                 = {Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts' presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.},
  ISBN                     = {978-3-642-36516-4},
  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@InProceedings{Hofstede-2009-SURFmap,
  Title                    = {{SURFmap: A Network Monitoring Tool Based on the Google Maps API}},
  Author                   = {Hofstede, Rick and Fioreze, Tiago},
  Booktitle                = {IFIP/IEEE International Symposium on Integrated Network Management (IM)},
  Year                     = {2009},
  Month                    = jun,
  Pages                    = {676--690},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InCollection{Hofstede-2010-Network,
  Title                    = {{The Network Data Handling War: MySQL vs. NfDump}},
  Author                   = {Hofstede, Rick and Sperotto, Anna and Fioreze, Tiago and Pras, Aiko},
  Booktitle                = {Networked Services and Applications - Engineering, Control and Management},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2010},
  Editor                   = {Aagesen, Finn Arve and Knapskog, Svein Johan},
  Pages                    = {167-176},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {6164},

  Doi                      = {10.1007/978-3-642-13971-0_16},
  Owner                    = {velan},
  Timestamp                = {2015.09.14}
}

@InProceedings{Hohlfeld-2012-Longtime,
  Title                    = {{Longtime Behavior of Harvesting Spam Bots}},
  Author                   = {Hohlfeld, Oliver and Graf, Thomas and Ciucu, Florin},
  Booktitle                = {{Proceedings of the 2012 ACM Conference on Internet Measurement Conference}},
  Year                     = {2012},

  Address                  = {New York, NY, USA},
  Pages                    = {453--460},
  Publisher                = {ACM},
  Series                   = {{IMC '12}},

  ISBN                     = {978-1-4503-1705-4},
  Location                 = {Boston, Massachusetts, USA},
  Numpages                 = {8},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Holz-2011-SSL,
  Title                    = {{The SSL Landscape: A Thorough Analysis of the X.509 PKI Using Active and Passive Measurements}},
  Author                   = {Holz, Ralph and Braun, Lothar and Kammenhuber, Nils and Carle, Georg},
  Booktitle                = {Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference},
  Year                     = {2011},

  Address                  = {New York, NY, USA},
  Pages                    = {427--444},
  Publisher                = {ACM},
  Series                   = {IMC '11},

  Abstract                 = {The SSL and TLS infrastructure used in important protocols like HTTPs and IMAPs is built on an X.509 public-key infrastructure (PKI). X.509 certificates are thus used to authenticate services like online banking, shopping, e-mail, etc. However, it always has been felt that the certification processes of this PKI may lack in stringency, resulting in a deployment where many certificates do not meet the requirements of a secure PKI. This paper presents a comprehensive analysis of X.509 certificates in the wild. To shed more light on the state of the deployed and actually used X.509 PKI, we obtained and evaluated data from many different sources. We conducted HTTPs scans of a large number of popular HTTPs servers over a 1.5-year time span, including scans from nine locations distributed over the globe. To compare certification properties of highly ranked hosts with the global picture, we included a third-party scan of the entire IPv4 space in our analyses. Furthermore, we monitored live SSL/TLS traffic on a 10Gbps uplink of a large research network. This allows us to compare the properties of the deployed PKI with the part of the PKI that is being actively accessed by users. Our analysis reveals that the quality of certification lacks in stringency, due to a number of reasons among which incorrect certification chains or invalid certificate subjects give the most cause for concern. Similar concerns can be raised for the properties of certification chains and many self-signed certificates used in the deployed X.509 PKI. Our findings confirm what has long been believed -- namely that the X.509 PKI we often use in our everyday's lives is in a sorry state.},
  Acmid                    = {2068856},
  Doi                      = {10.1145/2068816.2068856},
  ISBN                     = {978-1-4503-1013-0},
  Keywords                 = {HTTPS, SSL, TLS, X.509, certificates, public key infrastructure},
  Location                 = {Berlin, Germany},
  Numpages                 = {18},
  Owner                    = {velan},
  Review                   = {The paper describes one of the most complete SSL/TLS certificate analysis up to 2011. The analysis uses active and passive measurements and combines several different data sets. The focus is on: * Host analyses - Host replies with TLS/SSL - Negotiated ciphers and key lengths * Certificate properties - Certificate occurences - Validity of certification chains - Correct host names in certificate - Unusual host names in the common name - Extended validation - Length of certificate chain - Signature algorithms - Public key properties - Validity period - Intermediate certificates and certification chains - Different certificates between locations - Certificate issuers - Unique serial numbers, - X.509 version},
  Timestamp                = {2014.06.16},
  Url                      = {http://doi.acm.org/10.1145/2068816.2068856}
}

@Article{Hu-2014-Survey,
  Title                    = {{A Survey on Software-Defined Network and OpenFlow: From Concept to Implementation}},
  Author                   = {Hu, Fei and Hao, Qi and Bao, Ke},
  Journal                  = {IEEE Communications Surveys Tutorials},
  Year                     = {2014},
  Number                   = {4},
  Pages                    = {2181-2206},
  Volume                   = {16},

  Doi                      = {10.1109/COMST.2014.2326417},
  ISSN                     = {1553-877X},
  Keywords                 = {quality of service;routing protocols;software radio;OpenFlow implementation;SDN protocol;language abstraction;network routers;network switches;optical networks;quality of service;software-defined network;wireless networks;Control systems;Network architecture;Routing;Software defined networking;Software development;Virtual machining;OpenFlow;QoS;Software-defined network (SDN);network virtualization;security},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Article{Hu-2009-Entropy,
  Title                    = {{Entropy Based Adaptive Flow Aggregation}},
  Author                   = {Hu, Yan and Chiu, Dah-Ming and Lui, John C. S.},
  Journal                  = {IEEE/ACM Trans. Netw.},
  Year                     = {2009},

  Month                    = jun,
  Number                   = {3},
  Pages                    = {698--711},
  Volume                   = {17},

  Acmid                    = {1569734},
  Address                  = {Piscataway, NJ, USA},
  Doi                      = {10.1109/TNET.2008.2002560},
  ISSN                     = {1063-6692},
  Issue_date               = {June 2009},
  Keywords                 = {data summarization, information theory, network monitoring, traffic measurement},
  Numpages                 = {14},
  Owner                    = {velan},
  Publisher                = {IEEE Press},
  Timestamp                = {2015.07.30}
}

@Article{Huang-2014-tls-forward-secrecy,
  Title                    = {{An Experimental Study of TLS Forward Secrecy Deployments}},
  Author                   = {Huang, Lin-Shung and Adhikarla, Shrikant and Boneh, Dan and Jackson, Collin},
  Journal                  = {Internet Computing, IEEE},
  Year                     = {2014},

  Month                    = Nov,
  Number                   = {6},
  Pages                    = {43-51},
  Volume                   = {18},

  Abstract                 = {Many Transport Layer Security (TLS) servers use the ephemeral Diffie-Hellman (DHE) key exchange to support forward secrecy. However, in a survey of 473,802 TLS servers, the authors found that 82.9 percent of the DHE-enabled servers use weak DH parameters, resulting in a false sense of security. They compared the server throughput of various TLS setups, and measured real-world client-side latencies using an advertisement network. Their results indicate that using forward secrecy is no harder, and can even be faster using elliptic curve cryptography (ECC), than no forward secrecy.},
  Doi                      = {10.1109/MIC.2014.86},
  Keywords                 = {public key cryptography;DHE key exchange;DHE-enabled servers;ECC;TLS forward secrecy deployments;TLS servers;advertisement network;client-side latencies;elliptic curve cryptography;ephemeral Diffie-Hellman key exchange;server throughput;transport layer security servers;Browsers;Ciphers;Cryptography;DH-HEMTs;Elliptic curve cryptography;Internet;Network security;Servers;Throughput;Transport protocols;TLS;elliptic curve cryptography;forward secrecy},
  Owner                    = {Milan},
  Timestamp                = {2014.11.28},
  Url                      = {http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6870379}
}

@InProceedings{Hur-2012-Towards,
  Title                    = {{Towards Smart Phone Traffic Classification}},
  Author                   = {Hur, Min and Kim, Myung-Sup},
  Booktitle                = {Network Operations and Management Symposium (APNOMS), 2012 14th Asia-Pacific},
  Year                     = {2012},
  Month                    = sep,

  Doi                      = {10.1109/APNOMS.2012.6356064},
  Keywords                 = {hypermedia;smart phones;telecommunication computing;telecommunication network reliability;telecommunication traffic;transport protocols;HTTP user-agent field;LCS algorithm;accuracy rate;classification completeness;header signatures;industrial structure;paradigm shift;reliable networks;smart phone traffic analysis;smart phone traffic classification;smart phone traffic monitoring;target campus network;telecom market;Classification algorithms;Data mining;Engines;IP networks;Mobile communication;Servers;Smart phones;Smart phoene;Traffic Identification;Traffic classification;User-agent},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Husak-2014-PhiGARo,
  Title                    = {{PhiGARo: Automatic Phishing Detection and Incident Response Framework}},
  Author                   = {Husák, Martin and Čegan, Jakub},
  Booktitle                = {{Availability, Reliability and Security (ARES), 2014 Ninth International Conference on}},
  Year                     = {2014},
  Pages                    = {295-302},

  Doi                      = {10.1109/ARES.2014.46},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Husak-2015-Security,
  Title                    = {{Security Monitoring of HTTP Traffic Using Extended Flows}},
  Author                   = {Husák, Martin and Velan, Petr and Vykopal, Jan},
  Booktitle                = {2015 10th International Conference on Availability, Reliability and Security},
  Year                     = {2015},
  Month                    = Aug,
  Pages                    = {258-265},

  Abstract                 = {In this paper, we present an analysis of HTTP traffic in a large-scale environment which uses network flow monitoring extended by parsing HTTP requests. In contrast to previously published analyses, we were the first to classify patterns of HTTP traffic which are relevant to network security. We described three classes of HTTP traffic which contain brute-force password attacks, connections to proxies, HTTP scanners, and web crawlers. Using the classification, we were able to detect up to 16 previously undetectable brute-force password attacks and 19 HTTP scans per day in our campus network. The activity of proxy servers and web crawlers was also observed. Symptoms of these attacks may be detected by other methods based on traditional flow monitoring, but detection using the analysis of HTTP requests is more straightforward. We, thus, confirm the added value of extended flow monitoring in comparison to the traditional method.},
  Doi                      = {10.1109/ARES.2015.42},
  Keywords                 = {computer network security;program compilers;telecommunication traffic;transport protocols;HTTP request parsing;HTTP traffic;brute-force password attack;network flow monitoring;network security monitoring;Crawlers;IP networks;Monitoring;Protocols;Security;Web servers},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{iana-protocol-registries,
  Title                    = {{Protocol Registries}},
  Author                   = {{IANA - Internet Assigned Numbers Authority}},
  Url                      = {http://www.iana.org/protocols},
  Urldate                  = {2014-11-28},
  Year                     = {2014},

  Owner                    = {Milan},
  Timestamp                = {2014.11.28}
}

@Online{IETF-2014-IETF,
  Title                    = {{IETF 88 Proceedings, Technical Plenary}},
  Author                   = {{IETF}},
  Url                      = {http://www.ietf.org/proceedings/88/technical-plenary.html},
  Urldate                  = {2014-12-03},
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2014.12.03}
}

@InProceedings{Inacio-2010-YAF,
  Title                    = {{YAF: Yet Another Flowmeter}},
  Author                   = {Inacio, Christopher M. and Trammell, Brian},
  Booktitle                = {Proceedings of the 24th International Conference on Large Installation System Administration},
  Year                     = {2010},

  Address                  = {Berkeley, CA, USA},
  Pages                    = {1--16},
  Publisher                = {USENIX Association},
  Series                   = {LISA'10},

  Acmid                    = {1924987},
  Location                 = {San Jose, CA},
  Numpages                 = {16},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://dl.acm.org/citation.cfm?id=1924976.1924987}
}

@Online{IntelCorporation-2014-xl710,
  Title                    = {{Intel Ethernet Converged Network Adapters XL710 10/40 GbE}},
  Author                   = {{Intel Corporation}},
  Url                      = {http://www.intel.com/content/www/us/en/network-adapters/converged-network-adapters/ethernet-xl710.html},
  Urldate                  = {2018-02-21},
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2018.02.21}
}

@Online{IntelCorporation-2009-Introduction,
  Title                    = {{An Introduction to the Intel® QuickPath Interconnect}},
  Author                   = {{Intel Corporation}},
  Url                      = {https://www.intel.com/content/dam/doc/white-paper/quick-path-interconnect-introduction-paper.pdf},
  Urldate                  = {2017-11-15},

  Month                    = jan,
  Year                     = {2009},

  Owner                    = {velan},
  Timestamp                = {2017.11.15}
}

@Online{IANA-2017-IP,
  Title                    = {{IP Flow Information Export (IPFIX) Entities}},
  Author                   = {{Internet Assigned Numbers Authority}},
  Url                      = {https://www.iana.org/assignments/ipfix/ipfix.xhtml},
  Urldate                  = {2017-08-10},

  Month                    = sep,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.08.16}
}

@Online{IANA-2017-Service,
  Title                    = {{Service Name and Transport Protocol Port Number Registry}},
  Author                   = {{Internet Assigned Numbers Authority}},
  Url                      = {https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml},
  Urldate                  = {2017-10-12},

  Month                    = Oct,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.12}
}

@Online{IETF--Packet,
  Title                    = {{Packet Sampling (psamp) WG}},
  Author                   = {{Internet Engineering Task Force}},
  Url                      = {https://datatracker.ietf.org/wg/psamp/},
  Urldate                  = {2017-04-27},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{ISRG-2018-Lets,
  Title                    = {{Let's Encrypt Stats}},
  Author                   = {{Internet Security Research Group (ISRG)}},
  Url                      = {https://letsencrypt.org/stats/},
  Urldate                  = {2018-03-02},

  Month                    = mar,
  Year                     = {2018},

  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@Online{IP2Location--IP,
  Title                    = {{IP Address Geolocation to Identify Website Visitor's Geographical Location}},
  Author                   = {{IP2Location}},
  Url                      = {http://www.ip2location.com},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Book{ISO7948-1,
  Title                    = {{ISO/IEC 7498-1:1994 Information technology -- Open Systems Interconnection -- Basic Reference Model: The Basic Model}},
  Author                   = {ISO},
  Publisher                = {International Organization for Standardization},
  Year                     = {1994},

  Address                  = {Geneva, Switzerland},
  Edition                  = {2},
  Month                    = Nov,

  Keywords                 = {ISO/OSI model},
  Owner                    = {Milan},
  Timestamp                = {2014.12.03},
  Url                      = {http://www.iso.org/iso/catalogue_detail.htm?csnumber=20269}
}

@InProceedings{Jin-2012-Integrated,
  Title                    = {{Integrated Analysis Method on HTTP Traffic}},
  Author                   = {Jin, Chang-Gyu and Choi, Mi-Jung},
  Booktitle                = {Network Operations and Management Symposium (APNOMS), 2012 14th Asia-Pacific},
  Year                     = {2012},
  Month                    = sep,

  Keywords                 = {Internet;hypermedia;multimedia communication;online front-ends;quality of service;telecommunication security;telecommunication traffic;transport protocols;HTTP traffic;Internet traffic;QoS;Web browsing;integrated analysis method;multimedia services;quality of service;security;Algorithm design and analysis;Classification algorithms;Internet;Multimedia communication;Portals;Protocols;Servers;application anasysis;http traffic analysis;site analysis},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Article{Jirsik-2017-Toward,
  Title                    = {{Toward Stream-Based IP Flow Analysis}},
  Author                   = {Jirsik, Tomas and Cermak, Milan and Tovarnak, Daniel and Celeda, Pavel},
  Journal                  = {IEEE Communications Magazine},
  Year                     = {2017},
  Number                   = {7},
  Pages                    = {70-76},
  Volume                   = {55},

  Doi                      = {10.1109/MCOM.2017.1600972},
  ISSN                     = {0163-6804},
  Keywords                 = {Computer security;Data analysis;Delays;IP networks;Monitoring;Real-time systems;Telecommunication traffic},
  Owner                    = {velan},
  Timestamp                = {2017.08.04}
}

@InProceedings{John-2007-Analysis,
  Title                    = {{Analysis of Internet Backbone Traffic and Header Anomalies Observed}},
  Author                   = {John, Wolfgang and Tafvelin, Sven},
  Booktitle                = {Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2007},

  Address                  = {New York, NY, USA},
  Pages                    = {111--116},
  Publisher                = {ACM},
  Series                   = {IMC '07},

  Abstract                 = {The dominating Internet protocols, IP and TCP, allow some flexibility in implementation, including a variety of optional features. To support research and further development of these protocols, it is crucial to know about current deployment of protocol specific features and accompanying anomalies. This work is intended to reflect the current characteristics of Internet backbone traffic and point out misbehaviors and potential problems. On 20 consecutive days in April 2006 bidirectional traffic was collected on an OC-192 backbone link. The analysis of the data provides a comprehensive summary about current protocol usage including comparisons to prior studies. Furthermore, header misbehaviors and anomalies were found within almost every aspect analyzed and are discussed in detail. These observations are important information for designers of network protocols, network application and network attack detection systems.},
  Acmid                    = {1298321},
  Doi                      = {10.1145/1298306.1298321},
  ISBN                     = {978-1-59593-908-1},
  Keywords                 = {header anomalies, internet measurement, traffic analysis},
  Location                 = {San Diego, California, USA},
  Numpages                 = {6},
  Owner                    = {velan},
  Timestamp                = {2015.07.27},
  Url                      = {http://doi.acm.org/10.1145/1298306.1298321}
}

@InCollection{Kang-2007-Distributed,
  Title                    = {{Distributed Evasive Scan Techniques and Countermeasures}},
  Author                   = {Kang, MinGyung and Caballero, Juan and Song, Dawn},
  Booktitle                = {Detection of Intrusions and Malware, and Vulnerability Assessment},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2007},
  Editor                   = {M. H\"{a}mmerli, Bernhard and Sommer, Robin},
  Pages                    = {157-174},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {4579},

  ISBN                     = {978-3-540-73613-4},
  Keywords                 = {scan detection; evasion; distributed scanning; information-hiding},
  Language                 = {English},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Karagiannis-2005-BLINC,
  Title                    = {{BLINC: Multilevel Traffic Classification in the Dark}},
  Author                   = {Karagiannis, Thomas and Papagiannaki, Konstantina and Faloutsos, Michalis},
  Booktitle                = {Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications},
  Year                     = {2005},

  Address                  = {New York, NY, USA},
  Pages                    = {229--240},
  Publisher                = {ACM},
  Series                   = {SIGCOMM '05},

  Abstract                 = {We present a fundamentally different approach to classifying traffic flows according to the applications that generate them. In contrast to previous methods, our approach is based on observing and identifying patterns of host behavior at the transport layer. We analyze these patterns at three levels of increasing detail (i) the social, (ii) the functional and (iii) the application level. This multilevel approach of looking at traffic flow is probably the most important contribution of this paper. Furthermore, our approach has two important features. First, it operates in the dark, having (a) no access to packet payload, (b) no knowledge of port numbers and (c) no additional information other than what current flow collectors provide. These restrictions respect privacy, technological and practical constraints. Second, it can be tuned to balance the accuracy of the classification versus the number of successfully classified traffic flows. We demonstrate the effectiveness of our approach on three real traces. Our results show that we are able to classify 80\%-90\% of the traffic with more than 95\% accuracy.},
  Acmid                    = {1080119},
  Doi                      = {10.1145/1080091.1080119},
  ISBN                     = {1-59593-009-4},
  Keywords                 = {host behavior, traffic classification, transport layer},
  Location                 = {Philadelphia, Pennsylvania, USA},
  Numpages                 = {12},
  Owner                    = {velan},
  Review                   = {Authors focus more on Internet hosts than on individual flows. They classify their behavior on social, functional and application levels, without access to packet payloads or headers. Each level is classified independently and cross-level classification is performed afterwards. Particular applications are represented using graphlets, which are representations of applications' behavior. Authors then use heuristics to refine the classification.
The ground truth for used data sets is established by using payload-based classification.},
  Timestamp                = {2014.09.29},
  Url                      = {http://doi.acm.org/10.1145/1080091.1080119}
}

@InProceedings{Katz-Bassett-2006-Towards,
  Title                    = {{Towards IP Geolocation Using Delay and Topology Measurements}},
  Author                   = {Katz-Bassett, Ethan and John, John P. and Krishnamurthy, Arvind and Wetherall, David and Anderson, Thomas and Chawathe, Yatin},
  Booktitle                = {Proceedings of the 6th ACM SIGCOMM conference on Internet measurement (IMC)},
  Year                     = {2006},
  Pages                    = {71--84},
  Publisher                = {ACM},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InProceedings{Kawashima-2016-Host,
  Title                    = {{A Host-Based Performance Comparison of 40G NFV Environments Focusing on Packet Processing Architectures and Virtual Switches}},
  Author                   = {Kawashima, Ryota and Muramatsu, Shin and Nakayama, Hiroki and Hayashi, Tsunemasa and Matsuo, Hiroshi},
  Booktitle                = {2016 Fifth European Workshop on Software-Defined Networks (EWSDN)},
  Year                     = {2016},
  Month                    = oct,
  Pages                    = {19-24},

  Doi                      = {10.1109/EWSDN.2016.11},
  Keywords                 = {computer networks;parallel processing;virtual machines;virtualisation;40G NFV environments;L2FWD-DPDK;Lagopus;Linux Bridge;NAPI;OVS-DPDK;Open vSwitch;VALE;jitter;latency;netmap;network functions virtualization;packet processing architectures;physical virtual layers;virtual machines;virtual switches;Conferences;Europe;DPDK;NFV;VM;netmap;virtual switch},
  Owner                    = {velan},
  Timestamp                = {2018.02.09}
}

@Article{Kekely-2016-Software,
  Title                    = {{Software Defined Monitoring of Application Protocols}},
  Author                   = {Kekely, Lukas and Kucera, Jan and Pus, Viktor and Korenek, Jan and Vasilakos, Athanasios V.},
  Journal                  = {IEEE Trans. Comput.},
  Year                     = {2016},

  Month                    = feb,
  Number                   = {2},
  Pages                    = {615--626},
  Volume                   = {65},

  Acmid                    = {2914001},
  Address                  = {Washington, DC, USA},
  Doi                      = {10.1109/TC.2015.2423668},
  ISSN                     = {0018-9340},
  Issue_date               = {February 2016},
  Numpages                 = {12},
  Owner                    = {velan},
  Publisher                = {IEEE Computer Society},
  Timestamp                = {2017.04.28},
  Url                      = {http://dx.doi.org/10.1109/TC.2015.2423668}
}

@Article{Khakpour-2013-Information,
  Title                    = {{An Information-Theoretical Approach to High-Speed Flow Nature Identification}},
  Author                   = {Khakpour, Amir R. and Liu, Alex X.},
  Journal                  = {Networking, IEEE/ACM Transactions on},
  Year                     = {2013},

  Month                    = Aug,
  Number                   = {4},
  Pages                    = {1076-1089},
  Volume                   = {21},

  Abstract                 = {This paper concerns the fundamental problem of identifying the content nature of a flow-namely text, binary, or encrypted-for the first time. We propose Iustitia, a framework for identifying flow nature on the fly. The key observation behind Iustitia is that text flows have the lowest entropy and encrypted flows have the highest entropy, while the entropy of binary flows stands in between. We further extend Iustitia for the finer-grained classification of binary flows so that we can differentiate different types of binary flows (such as image, video, and executables) and even the file formats (such as JPEG and GIF for images, MPEG and AVI for videos) carried by binary flows. The basic idea of Iustitia is to classify flows using machine learning techniques where a feature is the entropy of every certain number of consecutive bytes. Our experimental results show that the classification can be done with high speed and high accuracy. On average, Iustitia can classify flows with 88.27\% of accuracy using a buffer size of 1 K with a classification time of less than 10\% of packet interarrival time for 91.2\% of flows.},
  Doi                      = {10.1109/TNET.2012.2219591},
  ISSN                     = {1063-6692},
  Keywords                 = {cryptography;data compression;entropy;image classification;learning (artificial intelligence);text analysis;video coding;AVI;GIF;Iustitia;JPEG;MPEG;binary flow classification;binary flow entropy;encrypted flows;high-speed flow nature identification;information-theoretical approach;machine learning techniques;packet interarrival time;text flows;Accuracy;Cryptography;Entropy;Payloads;Support vector machines;Training;Vectors;Flow content analysis;flow identification},
  Owner                    = {velan},
  Review                   = {Authors propose to use a machine learning method taking entropy of packets for traffic classification. They show that it is possible to classify the flows with 88.27\% accuracy into text, encrypted and binary categories. The used methods are decision tree (CART) and support vector machines. No other features except the entropy is used, but several formulas for entropy computations are combined. Cutoff threshold is used to strip application headers from unknown protocols, which increases the accuracy as the actual payload is taken into account. Furthemore, authors show that it is possible to determine encryption algorithm with higher accuracy than random guessing, which they find surprising.},
  Timestamp                = {2014.10.17}
}

@Article{Khalife-2014-multilevel,
  Title                    = {{A multilevel taxonomy and requirements for an optimal traffic-classification model}},
  Author                   = {Khalife, Jawad and Hajjar, Amjad and Diaz-Verdejo, Jesus},
  Journal                  = {International Journal of Network Management},
  Year                     = {2014},
  Number                   = {2},
  Pages                    = {101--120},
  Volume                   = {24},

  Abstract                 = {Identifying Internet traffic applications is essential for network security and management. The steady emergence of new Internet applications, together with the use of encryption and obfuscation techniques, ensures that traffic classification remains a hot research topic. Much research has been devoted to this topic by the research community in the last decade. However, an optimal traffic classification model has yet to be defined. Many techniques and formats have been described, with the current literature therefore lacking appropriate benchmarks expressed in a consistent terminology. Moreover, existing surveys are outdated and do not include many recent advances in the field. In this article, we present a systematic multilevel taxonomy that covers a broad range of existing and recently proposed methods, together with examples of vendor classification techniques. Our taxonomy assists in defining a consistent terminology. It could be useful in future benchmarking contexts by characterizing and comparing methods at three different levels. From this perspective, we describe key features and provide design hints for future classification models, while emphasizing the main requirements for promoting future research efforts. To motivate researchers and other interested parties, we collect and share data captured from real traffic, using two models to protect data privacy. Copyright © 2014 John Wiley & Sons, Ltd.},
  Doi                      = {10.1002/nem.1855},
  ISSN                     = {1099-1190},
  Owner                    = {velan},
  Review                   = {Authors provide taxonomy for traffic classification. The basic category groups are classification input (traffic payload, traffic properties and others), classification techniques (payload inspection, graphical, simple statistical, statistical machine learning, others) and classification output (mapping of traffic objects such as flows, packet or hosts to traffic classes, such as traffic clusters, application types, protocols, application software or anomaly). Future directions for optimal traffic classification are discussed and authors also promote code to data approach for comparison of methods. This approach allows researchers to send their code for traffic classification to the research group that can run it on unanonymised data.},
  Timestamp                = {2014.10.17},
  Url                      = {http://dx.doi.org/10.1002/nem.1855}
}

@InProceedings{Kim-2008-Internet,
  Title                    = {{Internet Traffic Classification Demystified: Myths, Caveats, and the Best Practices}},
  Author                   = {Kim, Hyunchul and Claffy, Kimberly C. and Fomenkov, Marina and Barman, Dhiman and Faloutsos, Michalis and Lee, KiYoung},
  Booktitle                = {Proceedings of the 2008 ACM CoNEXT Conference},
  Year                     = {2008},

  Address                  = {New York, NY, USA},
  Pages                    = {11:1--11:12},
  Publisher                = {ACM},
  Series                   = {CoNEXT '08},

  Abstract                 = {Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types of traffic, but no systematic comparison of the various algorithms. This fragmented approach to traffic classification research leaves the operational community with no basis for consensus on what approach to use when, and how to interpret results. In this work we critically revisit traffic classification by conducting a thorough evaluation of three classification approaches, based on transport layer ports, host behavior, and flow features. A strength of our work is the broad range of data against which we test the three classification approaches: seven traces with payload collected in Japan, Korea, and the US. The diverse geographic locations, link characteristics and application traffic mix in these data allowed us to evaluate the approaches under a wide variety of conditions. We analyze the advantages and limitations of each approach, evaluate methods to overcome the limitations, and extract insights and recommendations for both the study and practical application of traffic classification. We make our software, classifiers, and data available for researchers interested in validating or extending this work.},
  Acmid                    = {1544023},
  Articleno                = {11},
  Doi                      = {10.1145/1544012.1544023},
  ISBN                     = {978-1-60558-210-8},
  Location                 = {Madrid, Spain},
  Numpages                 = {12},
  Owner                    = {velan},
  Review                   = {The paper provides coherent comparison of several traffic classification algorithms based on ports, host behavior and flow features. Authors use seven traffic traces from Japan, Korea and US, which ensures variety od the traces. Performance of CoralReef (port based approach), BLINC (host behavior based) and seven commonly used machine learning algorithms is evaluated. Approaches are analyzed in detail and recommendations are made about the usage of these approaches. Highest accuracy is reported for SVM algorithm. Authors promote single-directional flow features including protocol and port numbers. The host behavior based methods strongly depends on topological location. The created code and data sets were made publicly available. Authors do not classify encrypted traffic to applications, but recognize SSL and SSH traffic as an encryption category in their work.},
  Timestamp                = {2014.10.17},
  Url                      = {http://doi.acm.org/10.1145/1544012.1544023}
}

@InProceedings{Koch-2010-Command,
  Title                    = {{Command Evaluation in Encrypted Remote Sessions}},
  Author                   = {Koch, Robert and Rodosek, Gabi Dreo},
  Booktitle                = {Proceedings of the 2010 Fourth International Conference on Network and System Security},
  Year                     = {2010},

  Address                  = {Washington, DC, USA},
  Pages                    = {299--305},
  Publisher                = {IEEE Computer Society},
  Series                   = {NSS '10},

  Abstract                 = {Intrusion Detection Systems (IDS) are integral components for the detection of malicious code and attacks. Detection methods can be differentiated in signature-based and anomaly-based systems. While the former ones search for well-known patterns which are available in a database, the latter ones build a model of the normal behavior of a network and later on attacks can be detected by measuring significant deviation of the network status against the normal behavior described by the model. Often this requires the availability of the payload of the network packets. If encryption protocols like SSL or SSH are used, searching for attack signatures in the payload is not possible any longer and also the usage of behavior based techniques is limited: Statistical methods like flow evaluation can be used for anomaly detection, but application level attacks hidden in the encrypted traffic can be undetectable. At the moment, only a few systems are designed to cope with encrypted network traffic. Even so, none of these systems can be easily deployed in general because of the need for protocol modifications, special infrastructures or because of high false alarm rates which are not acceptable in a production environment. In this paper, we propose a new IDS for encrypted traffic which identifies command sequences in encrypted network traffic and evaluates the attack possibility of them. The encrypted traffic is clustered and possibilities for different commands are calculated. Based on that, command sequences are analysed. The system evaluates probabilities for commands and command sequences and the likeliness for an attack based on the identified sequences without a decryption of the packets. Because of only using statistical data gathered from the network traffic, the system can be deployed in general. The current prototype of the system focuses on the command evaluation.},
  Acmid                    = {1915155},
  Doi                      = {10.1109/NSS.2010.62},
  ISBN                     = {978-0-7695-4159-4},
  Keywords                 = {IDS, Intrusion Detection, Encryption, SSH, Statistical Analysis, Command Evaluation, Remote Sessions, Network Security},
  Numpages                 = {7},
  Owner                    = {velan},
  Review                   = {Authors propose a system for detection of interactive attacks on SSH. Clusters are created from the traffic based on entered commands and corresponding answers. Commands are distinguished using interarrival times and sizes of the packets. Authors take typical commands and their sequences and try to match them to the clusters using packet sizes and coincidence. The SSH is recognized as traffic on TCP port 22.},
  Timestamp                = {2014.10.22},
  Url                      = {http://dx.doi.org/10.1109/NSS.2010.62}
}

@InProceedings{Korczynski-2014-Markov,
  Title                    = {{Markov Chain Fingerprinting to Classify Encrypted Traffic}},
  Author                   = {Korczynski, Maciej and Duda, Andrzej},
  Booktitle                = {INFOCOM, 2014 Proceedings IEEE},
  Year                     = {2014},
  Month                    = Apr,
  Pages                    = {781-789},

  Abstract                 = {In this paper, we propose stochastic fingerprints for application traffic flows conveyed in Secure Socket Layer/Transport Layer Security (SSL/TLS) sessions. The fingerprints are based on first-order homogeneous Markov chains for which we identify the parameters from observed training application traces. As the fingerprint parameters of chosen applications considerably differ, the method results in a very good accuracy of application discrimination and provides a possibility of detecting abnormal SSL/TLS sessions. Our analysis of the results reveals that obtaining application discrimination mainly comes from incorrect implementation practice, the misuse of the SSL/TLS protocol, various server configurations, and the application nature.},
  Doi                      = {10.1109/INFOCOM.2014.6848005},
  Keywords                 = {Internet;Markov processes;computer network security;cryptographic protocols;fingerprint identification;Markov chain fingerprinting;SSL/TLS protocol;SSL/TLS sessions;encrypted traffic classification;fingerprint parameters;secure socket layer/transport layer security;stochastic fingerprints;Ciphers;Markov processes;Protocols;Servers;Twitter},
  Owner                    = {velan},
  Review                   = {Autors use Markov chains based stochastic fingerprints for identification of application traffic in SSL/TLS sessions. The method is payload-based and uses statistical information from SSL/TLS headers. Authors test their method on twelve representative applications such as Twitter, Skype and Dropbox. The Markov chain fingerprints are based on distributions of packets in time. This work uses specific properties of each protocols to create appropriate fingerprints. Data sets are real, private and contain only SSL/TLS traffic. The ground truth is obtained by inspecting domain names of the SSL/TLS traffic. Authors discovered that many protocol implementations differ from RFC specification.},
  Timestamp                = {2015.03.13}
}

@InProceedings{Korczynski-2012-Classifying,
  Title                    = {{Classifying Service Flows in the Encrypted Skype Traffic}},
  Author                   = {Korczynski, Maciej and Duda, Andrzej},
  Booktitle                = {Communications (ICC), 2012 IEEE International Conference on},
  Year                     = {2012},
  Month                    = Jun,
  Pages                    = {1064-1068},

  Abstract                 = {In this paper, we consider the problem of detecting Skype traffic and classifying Skype service flows such as voice calls, skypeOut, video conferencing, chat, file upload and download. We propose a classification method for Skype encrypted traffic based on the Statistical Protocol IDentification (SPID) that analyzes statistical values of some traffic attributes. We have evaluated our method on a representative dataset to show excellent performance in terms of Precision and Recall.},
  Doi                      = {10.1109/ICC.2012.6364024},
  ISSN                     = {1550-3607},
  Keywords                 = {Internet telephony;cryptography;protocols;statistical analysis;telecommunication traffic;SPID analysis;Skype service flow classification method;Skype traffic detection;Skype traffic encryption;precision-recall term;representative dataset method;skypeOut;statistical protocol identification analysis;video conferencing;voice call;Analysis of variance;Computational modeling;Cryptography;Fingerprint recognition;Peer to peer computing;Protocols},
  Location                 = {Ottawa, Canada},
  Owner                    = {velan},
  Review                   = {Authors designed a method to identify types of communication (voice call, skypeOut, video conference, chat, file upload, file download) in Skype traffic. Authors use Statistical Protocol IDentification (SPID). Flow features are selected using forward selection which evalueates how a given feature improves classification performance. 9 features were selected such as byte frequency. Private, artificial data set with skype traffic was used. Other traffic with SSL, SSH, HTTP, SCP, SFTP, VoIP, BitTorrent ad other services was used to test robustness of the method. The method works very well, although the distinction between voice and video traffic has lower precision and recall.},
  Timestamp                = {2015.03.13}
}

@InProceedings{Krmicek-2009-Netflow,
  Title                    = {{Netflow Based System for NAT Detection}},
  Author                   = {Krmicek, Vojtech and Vykopal, Jan and Krejci, Radek},
  Booktitle                = {Proceedings of the 5th International Student Workshop on Emerging Networking Experiments and Technologies},
  Year                     = {2009},

  Address                  = {New York, NY, USA},
  Pages                    = {23--24},
  Publisher                = {ACM},
  Series                   = {Co-Next Student Workshop '09},

  Acmid                    = {1659010},
  Doi                      = {10.1145/1658997.1659010},
  ISBN                     = {978-1-60558-751-6},
  Keywords                 = {detection, netflow, network address translation, network security},
  Location                 = {Rome, Italy},
  Numpages                 = {2},
  Owner                    = {velan},
  Timestamp                = {2017.05.25},
  Url                      = {http://doi.acm.org/10.1145/1658997.1659010}
}

@InProceedings{Kumano-2014-Towards,
  Title                    = {{Towards real-time processing for application identification of encrypted traffic}},
  Author                   = {Kumano, Yuichi and Ata, Shingo and Nakamura, Nobuyuki and Nakahira, Yoshihiro and Oka, Ikuo},
  Booktitle                = {Computing, Networking and Communications (ICNC), 2014 International Conference on},
  Year                     = {2014},
  Month                    = Feb,
  Pages                    = {136-140},

  Abstract                 = {Application identification in the middle is one of key challenges for network operators to manage application based traffic and policy controls in the Internet. However, it is becoming harder according to the increase of end-to-end encrypted traffic in which we hardly read application specific information from packets. We previously proposed a method to identify the application of traffic whenever the traffic is encrypted or not. Our method gives a significant accuracy of identification of encrypted traffic as high as the case when traffic is not encrypted, however, it requires an offline processing to obtain statistics of the whole of flows. A real-time identification is important, but the accuracy is a problem due to unstable information of flow statistics. In this paper we therefore propose an approach to improve the accuracy of identification when we identify the encrypted traffic in real-time. We first clarify the sufficient number of packets required for accurate identification, and then the method to infer the statistics to improve the accuracy even when the obtained number of packets is smaller than the one required. Experimental results have shown that the proposed approach achieves the high accuracy almost the same as in offline method.},
  Doi                      = {10.1109/ICCNC.2014.6785319},
  Keywords                 = {Internet;computer network security;cryptography;identification;telecommunication traffic;Internet;application based traffic;application specific information;encrypted traffic identification;end-to-end encrypted traffic;flow statistics;offline processing;policy controls;real-time processing;Accuracy;Degradation;Encryption;Monitoring;Real-time systems;Training data},
  Location                 = {Honolulu, Hawaii, USA},
  Owner                    = {velan},
  Review                   = {Authors modify previous method of application identification in encrypted traffic, which uses whole flows for the identification. They evaluate an impact of using fixed number of packets for the evaluation and suggest to remove or modify features that decrease the accuracy of the identification. The method uses machine learning and support vector machines in particular. The paper is written in very bad english and the experiments are often inconclusive. The important result is that the encryption affects some of the features more strongly than others.},
  Timestamp                = {2014.08.22}
}

@InProceedings{Lai-2004-Parallel,
  Title                    = {{A Parallel Intrusion Detection System for High-Speed Networks}},
  Author                   = {Lai, Haiguang and Cai, Shengwen and Huang, Hao and Xie, Junyuan and Li, Hui},
  Booktitle                = {Applied Cryptography and Network Security},
  Year                     = {2004},
  Editor                   = {Jakobsson, Markus and Yung, Moti and Zhou, Jianying},
  Pages                    = {439-451},
  Publisher                = {Springer Berlin Heidelberg},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {3089},

  Doi                      = {10.1007/978-3-540-24852-1_32},
  ISBN                     = {978-3-540-22217-0},
  Owner                    = {velan},
  Timestamp                = {2017.08.24},
  Url                      = {http://dx.doi.org/10.1007/978-3-540-24852-1_32}
}

@Online{Lancope--Stealthwatch,
  Title                    = {{Stealthwatch FlowSensor}},
  Author                   = {Lancope},
  Url                      = {https://www.lancope.com/products/stealthwatch-flowsensor},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@InProceedings{Lastovicka-2017-Situational,
  Title                    = {{Situational Awareness: Detecting Critical Dependencies and Devices in a Network}},
  Author                   = {Laštovička, Martin and Čeleda, Pavel},
  Booktitle                = {Security of Networks and Services in an All-Connected World: 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017, Zurich, Switzerland, July 10-13, 2017, Proceedings},
  Year                     = {2017},

  Address                  = {Cham},
  Editor                   = {Tuncer, Daphne
and Koch, Robert
and Badonnel, R{\'e}mi
and Stiller, Burkhard},
  Pages                    = {173--178},
  Publisher                = {Springer International Publishing},

  Abstract                 = {Large-scale networks consisting of thousands of connected devices are like a living organism, constantly changing and evolving. It is very difficult for a human administrator to orient in such environment and to react to emerging security threats. With such motivation, this PhD proposal aims to find new methods for automatic identification of devices, the services they provide, their dependencies and importance. The main focus of the proposal is to find novel approaches to building cyber situational awareness in an unknown network for the purpose of computer security incident response. Our research is at the initial phase and will contribute to a PhD thesis in four years.},
  Doi                      = {10.1007/978-3-319-60774-0_17},
  ISBN                     = {978-3-319-60774-0},
  Owner                    = {velan},
  Timestamp                = {2017.08.09},
  Url                      = {https://doi.org/10.1007/978-3-319-60774-0_17}
}

@InProceedings{Lee-2007-End,
  Title                    = {{End-to-end Flow Monitoring with IPFIX}},
  Author                   = {Lee, Byungjoon and Son, Hyeongu and Yoon, Seunghyun and Lee, Youngseok},
  Booktitle                = {Proceedings of the 10th Asia-Pacific Conference on Network Operations and Management Symposium: Managing Next Generation Networks and Services},
  Year                     = {2007},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {225--234},
  Publisher                = {Springer-Verlag},
  Series                   = {APNOMS'07},

  Acmid                    = {2401883},
  ISBN                     = {978-3-540-75475-6},
  Location                 = {Sapporo, Japan},
  Numpages                 = {10},
  Owner                    = {velan},
  Timestamp                = {2017.05.31},
  Url                      = {http://dl.acm.org/citation.cfm?id=2401855.2401883}
}

@Article{Lee-2015-Flow,
  Title                    = {{A Flow Measurement Architecture to Preserve Application Structure}},
  Author                   = {Lee, Myungjin and Hajjat, Mohammad and Kompella, Ramana Rao and Rao, Sanjay G.},
  Journal                  = {Comput. Netw.},
  Year                     = {2015},

  Month                    = feb,
  Number                   = {C},
  Pages                    = {181--195},
  Volume                   = {77},

  Acmid                    = {2741304},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1016/j.comnet.2014.11.005},
  ISSN                     = {1389-1286},
  Issue_date               = {February 2015},
  Keywords                 = {NetFlow, Network management, Related sampling},
  Numpages                 = {15},
  Owner                    = {velan},
  Publisher                = {Elsevier North-Holland, Inc.},
  Timestamp                = {2015.07.30}
}

@Article{Lee-2012-Toward,
  Title                    = {{Toward Scalable Internet Traffic Measurement and Analysis with Hadoop}},
  Author                   = {Lee, Yeonhee and Lee, Youngseok},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2012},

  Month                    = jan,
  Number                   = {1},
  Pages                    = {5--13},
  Volume                   = {43},

  Acmid                    = {2427038},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/2427036.2427038},
  ISSN                     = {0146-4833},
  Issue_date               = {January 2013},
  Keywords                 = {analysis, hadoop, hive, mapreduce, netflow, packet, pcap, traffic measurement},
  Numpages                 = {9},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.08.03},
  Url                      = {http://doi.acm.org/10.1145/2427036.2427038}
}

@InProceedings{Lee-2007-IPv6,
  Title                    = {{IPv6 Anomaly Traffic Monitoring with IPFIX}},
  Author                   = {Lee, Youngseok and Shin, Seongho and Choi, Soonbyoung and Son, Hyeon-gu},
  Booktitle                = {Proceedings of the Second International Conference on Internet Monitoring and Protection},
  Year                     = {2007},

  Address                  = {Washington, DC, USA},
  Pages                    = {10--},
  Publisher                = {IEEE Computer Society},
  Series                   = {ICIMP '07},

  Acmid                    = {1271112},
  Doi                      = {10.1109/ICIMP.2007.23},
  ISBN                     = {0-7695-2911-9},
  Owner                    = {velan},
  Timestamp                = {2017.05.31},
  Url                      = {http://dx.doi.org/10.1109/ICIMP.2007.23}
}

@InProceedings{Leland-1993-Self,
  Title                    = {{On the Self-similar Nature of Ethernet Traffic}},
  Author                   = {Leland, Will E. and Taqqu, Murad S. and Willinger, Walter and Wilson, Daniel V.},
  Booktitle                = {Conference Proceedings on Communications Architectures, Protocols and Applications},
  Year                     = {1993},

  Address                  = {New York, NY, USA},
  Pages                    = {183--193},
  Publisher                = {ACM},
  Series                   = {SIGCOMM '93},

  Abstract                 = {We demonstrate that Ethernet local area network (LAN) traffic is statistically self-similar, that none of the commonly used traffic models is able to capture this fractal behavior, and that such behavior has serious implications for the design, control, and analysis of high-speed, cell-based networks. Intuitively, the critical characteristic of this self-similar traffic is that there is no natural length of a "burst": at every time scale ranging from a few milliseconds to minutes and hours, similar-looking traffic bursts are evident; we find that aggregating streams of such traffic typically intensifies the self-similarity ("burstiness") instead of smoothing it.Our conclusions are supported by a rigorous statistical analysis of hundreds of millions of high quality Ethernet traffic measurements collected between 1989 and 1992, coupled with a discussion of the underlying mathematical and statistical properties of self-similarity and their relationship with actual network behavior. We also consider some implications for congestion control in high-bandwidth networks and present traffic models based on self-similar stochastic processes that are simple, accurate, and realistic for aggregate traffic.},
  Acmid                    = {166255},
  Doi                      = {10.1145/166237.166255},
  ISBN                     = {0-89791-619-0},
  Location                 = {San Francisco, California, USA},
  Numpages                 = {11},
  Owner                    = {velan},
  Timestamp                = {2015.07.27}
}

@TechReport{Lesk-1975-Lex,
  Title                    = {{Lex -- a Lexical Analyzer Generator}},
  Author                   = {Lesk, Mike E. and Schmidt, Eric},
  Institution              = {Bell Laboratories},
  Year                     = {1975},
  Note                     = {{C}omputing {S}cience {T}echnical {R}eport {N}o.\ 39},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Book{Levine-2009-Flex,
  Title                    = {{Flex \& Bison}},
  Author                   = {Levine, John and John, Levine},
  Publisher                = {{O'Reilly Media, Inc.}},
  Year                     = {2009},
  Edition                  = {1st},

  ISBN                     = {978-0596155971},
  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Article{Li-2013-Review,
  Title                    = {{Review: A Survey of Network Flow Applications}},
  Author                   = {Li, Bingdong and Springer, Jeff and Bebis, George and Hadi Gunes, Mehmet},
  Journal                  = {J. Netw. Comput. Appl.},
  Year                     = {2013},

  Month                    = mar,
  Number                   = {2},
  Pages                    = {567--581},
  Volume                   = {36},

  Acmid                    = {2444244},
  Address                  = {London, UK, UK},
  Doi                      = {10.1016/j.jnca.2012.12.020},
  ISSN                     = {1084-8045},
  Issue_date               = {March, 2013},
  Keywords                 = {Machine learning, NetFlow, Network security, Network traffic analysis, sFlow},
  Numpages                 = {15},
  Owner                    = {velan},
  Publisher                = {Academic Press Ltd.},
  Timestamp                = {2017.08.03},
  Url                      = {http://dx.doi.org/10.1016/j.jnca.2012.12.020}
}

@Online{Liberouter--COMBO,
  Title                    = {{COMBO-80G}},
  Author                   = {Liberouter},
  Url                      = {https://www.liberouter.org/combo-80g/},
  Urldate                  = {2018-02-21},

  Owner                    = {velan},
  Timestamp                = {2018.02.21}
}

@Online{Liberouter--Hanic,
  Title                    = {{Hanic Design}},
  Author                   = {Liberouter},
  Url                      = {https://www.liberouter.org/technologies/hanic/},
  Urldate                  = {2018-02-19},

  Owner                    = {velan},
  Timestamp                = {2018.02.19}
}

@Online{LFP--Data,
  Title                    = {{Data Plane Development Kit}},
  Author                   = {{Linux Foundation Project}},
  Url                      = {https://dpdk.org},
  Urldate                  = {2018-02-13},

  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Online{LFP--DPDK,
  Title                    = {{DPDK Supported NICs}},
  Author                   = {{Linux Foundation Project}},
  Url                      = {http://dpdk.org/doc/nics},
  Urldate                  = {2018-02-13},

  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Online{LinuxKernelOrganization-2017-PACKETMMAP,
  Title                    = {{PACKET\_MMAP}},
  Author                   = {Linux Kernel Organization, Inc.},
  Url                      = {https://www.kernel.org/doc/Documentation/networking/packet\_mmap.txt},
  Urldate                  = {2018-02-09},

  Month                    = nov,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2018.02.09}
}

@Article{Madhyastha-2008-Generic,
  Title                    = {{A Generic Language for Application-specific Flow Sampling}},
  Author                   = {Madhyastha, Harsha V. and Krishnamurthy, Balachander},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2008},

  Month                    = mar,
  Number                   = {2},
  Pages                    = {5--16},
  Volume                   = {38},

  Acmid                    = {1355736},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/1355734.1355736},
  ISSN                     = {0146-4833},
  Issue_date               = {April 2008},
  Keywords                 = {application-specific traffic monitoring, flow sampling, language design},
  Numpages                 = {12},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2015.07.30}
}

@Article{Mahanti-2011-Characterizing,
  Title                    = {{Characterizing the file hosting ecosystem: A view from the edge}},
  Author                   = {Mahanti, Aniket and Williamson, Carey and Carlsson, Niklas and Arlitt, Martin and Mahanti, Anirban},
  Journal                  = {Perform. Eval.},
  Year                     = {2011},

  Month                    = nov,
  Number                   = {11},
  Pages                    = {1085--1102},
  Volume                   = {68},

  Acmid                    = {2039701},
  Address                  = {Amsterdam, The Netherlands, The Netherlands},
  Doi                      = {10.1016/j.peva.2011.07.016},
  ISSN                     = {0166-5316},
  Issue_date               = {November, 2011},
  Keywords                 = {Content distribution, File hosting services, Internet measurement, Peer-to-peer, Performance},
  Numpages                 = {18},
  Owner                    = {velan},
  Publisher                = {Elsevier Science Publishers B. V.},
  Timestamp                = {2017.10.18},
  Url                      = {http://dx.doi.org/10.1016/j.peva.2011.07.016}
}

@InCollection{Maiolini-2009-Real,
  Title                    = {{Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques}},
  Author                   = {Maiolini, Gianluca and Baiocchi, Andrea and Iacovazzi, Alfonso and Rizzi, Antonello},
  Booktitle                = {NETWORKING 2009},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2009},
  Editor                   = {Fratta, Luigi and Schulzrinne, Henning and Takahashi, Yutaka and Spaniol, Otto},
  Pages                    = {182-194},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {5550},

  Abstract                 = {The identification of application flows is a critical task in order to manage bandwidth requirements of different kind of services (i.e. VOIP, Video, ERP). As network security functions spread, an increasing amount of traffic is natively encrypted due to privacy issues (e.g. VPN). This makes ineffective current traffic classification systems based on ports and payload inspection, e.g. even powerful Deep Packet Inspection is useless to classify application flow carried inside SSH sessions. We have developed a real time traffic classification method based on cluster analysis to identify SSH flows from statistical behavior of IP traffic parameters, such as length, arrival times and direction of packets. In this paper we describe our approach and relevant obtained results. We achieve detection rate up to 99.5 \% in classifying SSH flows and accuracy up to 99.88 \% for application flows carried within those flows, such as SCP, SFTP and HTTP over SSH.},
  Doi                      = {10.1007/978-3-642-01399-7_15},
  ISBN                     = {978-3-642-01398-0},
  Keywords                 = {Traffic analysis; statistical traffic classification; SSH; cluster analysis; k-means},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {Authors use K-Means clustering to identify SSH traffic and determine underlying protocols (SCP, SFTP, HTTP). Only three packet features are used: direction, bytes and timestamps of each packet. Private data sets are created from artificial traffic. The traffic contains HTTP, FTP, POP3 and SSH protocols, control packets are removed from statistics (TCP handshake, retransmitted packets, ACK only packets). Authors use only first 3-7 packets to achieve a real time identification.},
  Timestamp                = {2015.03.11},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-01399-7_15}
}

@Online{p0f-ssl-fingerprint,
  Title                    = {{SSL fingerprinting for p0f}},
  Author                   = {Majkowski, Marek},
  Url                      = {https://idea.popcount.org/2012-06-17-ssl-fingerprinting-for-p0f/},
  Urldate                  = {2014-11-28},

  Month                    = Jun,
  Year                     = {2012},

  Keywords                 = {SSL, TLS, fingeprinting},
  Owner                    = {Milan},
  Timestamp                = {2014.11.28}
}

@Online{Mallat-2017-UASparser,
  Title                    = {{UASparser}},
  Author                   = {Mallat, Jaroslav},
  Url                      = {http://user-agent-string.info/download/UASparser},
  Urldate                  = {2017-10-20},
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Mansley-2008-Getting,
  Title                    = {{Getting 10 Gb/s from Xen: Safe and Fast Device Access from Unprivileged Domains}},
  Author                   = {Mansley, Kieran and Law, Greg and Riddoch, David and Barzini, Guido and Turton, Neil and Pope, Steven},
  Booktitle                = {Euro-Par 2007 Workshops: Parallel Processing},
  Year                     = {2008},

  Address                  = {Berlin, Heidelberg},
  Editor                   = {Boug{\'e}, Luc
and Forsell, Martti
and Tr{\"a}ff, Jesper Larsson
and Streit, Achim
and Ziegler, Wolfgang
and Alexander, Michael
and Childs, Stephen},
  Pages                    = {224--233},
  Publisher                = {Springer Berlin Heidelberg},

  Abstract                 = {The networking performance available to Virtual Machines (VMs) can be low due to the inefficiencies of transferring network packets between the host domain and guests. This can limit the application-level performance of VMs on a 10 Gb/s network. To improve network performance, we have created a ``virtualization aware'' smart network adapter and modified Xen to allow direct, but safe, access to such adapters from guest operating systems. Networking overheads are reduced considerably, and the host domain is removed as a bottleneck, resulting in significantly improved performance.},
  ISBN                     = {978-3-540-78474-6},
  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Online{MaxMind--GeoLite,
  Title                    = {{GeoLite Databases}},
  Author                   = {{MaxMind}},
  Url                      = {http://www.maxmind.com/app/geoip_country},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Misc{MaxMind-2013-MaxMind,
  Title                    = {{MaxMind GeoIP services}},

  Author                   = {{MaxMind, Inc.}},
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2017.10.25},
  Url                      = {http://www.maxmind.com}
}

@Article{McNaughton-1960-Regular,
  Title                    = {{Regular Expressions and State Graphs for Automata}},
  Author                   = {McNaughton, Robert and Yamada, Hisao},
  Journal                  = {Electronic Computers, IRE Transactions on},
  Year                     = {1960},
  Number                   = {1},
  Pages                    = {39-47},
  Volume                   = {EC-9},

  Doi                      = {10.1109/TEC.1960.5221603},
  ISSN                     = {0367-9950},
  Keywords                 = {Automata;Terminology},
  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@PhdThesis{tls-thesis,
  Title                    = {{20 Years of SSL/TLS Research An Analysis of the Internet’s Security Foundation}},
  Author                   = {Meyer, Christopher},
  School                   = {Ruhr-University Bochum},
  Year                     = {2014},
  Month                    = Feb,

  Abstract                 = {Since its introduction in 1994 the Secure Socket Layer (SSL) protocol (later renamed to Transport Layer Security (TLS)) evolved to the de facto standard for securing the transport layer. SSL/TLS can be used for ensuring data confidentiality, integrity and authenticity during transport. A main feature of the protocol is its flexibility. Modes of operation and security goals can easily be configured through different cipher suites.
This thesis focuses on the SSL/TLS protocol suites for secure communication over untrusted media (the internet). It explains the protcol in depth (in the – at the time of writing – most common version TLS 1.0), provides a brief summary on its evolution and gives a detailed chronology of attacks and attack categories. New techniques for fingerprinting particular SSL/TLS implementations (stacks), partially down to patch level, are introduced and implemented as a tool for SSL/TLS stack inspection.
Moreover, new attacks on state of the art implementations are given and a new framework, called T.I.M.E., especially designed for deep protocol inspection and penetration is presented. The attacks undermine the security goal confidentiality. Exploits for the discussed attacks are implemented by using the T.I.M.E framework. The results caused changes (fixes) in the affected implementations and highlight the need for tested, specification compliant and security optimized software.},
  Keywords                 = {TLS, Transport Layer Security, SSL, Secure Socket Layer, Attacks, Survey},
  Owner                    = {Milan},
  Review                   = {Velmi pěkný přeheld o SSL/TLS a všech útocích, které na ně byly za 20 let provedeny.},
  Timestamp                = {2014.10.17},
  Url                      = {http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/MeyerChristopher/diss.pdf}
}

@InCollection{Miller-2014-https-decrypt,
  Title                    = {{I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis}},
  Author                   = {Miller, Brad and Huang, Ling and Joseph, Anthony D. and Tygar, J.D.},
  Booktitle                = {Privacy Enhancing Technologies},
  Publisher                = {Springer International Publishing},
  Year                     = {2014},
  Pages                    = {143-163},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {8555},

  Abstract                 = {Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 90\% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 17\% caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 25\% with a 9\% traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user-specific cookies and pages within the same website.},
  Doi                      = {10.1007/978-3-319-08506-7_8},
  Owner                    = {Milan},
  Timestamp                = {2014.11.28},
  Url                      = {http://dx.doi.org/10.1007/978-3-319-08506-7_8}
}

@Article{Molina-2006-Design,
  Title                    = {{Design Principles and Algorithms for Effective High-speed IP Flow Monitoring}},
  Author                   = {Molina, Maurizio and Chiosi, Agostino and D'Antonio, Salvatore and Ventre, Giorgio},
  Journal                  = {Comput. Commun.},
  Year                     = {2006},

  Month                    = jun,
  Number                   = {10},
  Pages                    = {1653--1664},
  Volume                   = {29},

  Acmid                    = {1647081},
  Address                  = {Amsterdam, The Netherlands, The Netherlands},
  Doi                      = {10.1016/j.comcom.2005.07.024},
  ISSN                     = {0140-3664},
  Issue_date               = {June, 2006},
  Keywords                 = {IP flow monitoring, Passive traffic measurements},
  Numpages                 = {12},
  Owner                    = {velan},
  Publisher                = {Elsevier Science Publishers B. V.},
  Timestamp                = {2017.04.28},
  Url                      = {http://dx.doi.org/10.1016/j.comcom.2005.07.024}
}

@TechReport{Moore-2005-Discriminators,
  Title                    = {{Discriminators for use in flow-based classification}},
  Author                   = {Moore, Andrew and Crogan, Michael and Zuev, Denis},
  Institution              = {Queen Mary, University of London},
  Year                     = {2005},

  Owner                    = {velan},
  Review                   = {The report describes data sets that were made available by the researches for the purposes of flow-based classification training evaluation. IT contains description of 249 discriminators that can be used by the classificators. It is certainly a good starting point to look for flow features to measure.},
  Timestamp                = {2014.08.22},
  Url                      = {http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.101.7450&rep=rep1&type=pdf}
}

@InProceedings{Moore-2005-Toward,
  Title                    = {{Toward the Accurate Identification of Network Applications}},
  Author                   = {Moore, Andrew W. and Papagiannaki, Konstantina},
  Booktitle                = {Proceedings of the 6th International Conference on Passive and Active Network Measurement},
  Year                     = {2005},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {41--54},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'05},

  Acmid                    = {2150199},
  Doi                      = {10.1007/978-3-540-31966-5_4},
  ISBN                     = {978-3-540-25520-8},
  Location                 = {Boston, MA},
  Numpages                 = {14},
  Owner                    = {velan},
  Timestamp                = {2015.09.07}
}

@PhdThesis{MoreiraMoura-2013-Internet,
  Title                    = {{Internet Bad Neighborhoods}},
  Author                   = {{Moreira Moura}, Giovane César},
  School                   = {University of Twente},
  Year                     = {2013},

  Address                  = {Enschede},
  Month                    = mar,

  Owner                    = {velan},
  Publisher                = {University of Twente},
  Series                   = {CTIT Ph.D. thesis series ; no. 12-237},
  Timestamp                = {2017.10.20},
  Url                      = {http://doc.utwente.nl/84507/}
}

@InProceedings{Murray-2012-State,
  Title                    = {{The State of Enterprise Network Traffic in 2012}},
  Author                   = {Murray, David and Koziniec, Terrys},
  Booktitle                = {2012 18th Asia-Pacific Conference on Communications (APCC)},
  Year                     = {2012},
  Month                    = Oct,
  Pages                    = {179-184},

  Doi                      = {10.1109/APCC.2012.6388126},
  ISSN                     = {2163-0771},
  Keywords                 = {Internet;telecommunication traffic;DCSP;ECN;Internet statistics;Internet traffic;MSS;RTT;SACK;active measurement techniques;enterprise network traffic;packet size distribution;passive measurement techniques;round trip times;timestamps;transport layer statistics;university network;window scaling;Educational institutions;IP networks;Internet;Servers},
  Owner                    = {velan},
  Timestamp                = {2017.06.21}
}

@InProceedings{Nassopulos-2014-Flow,
  Title                    = {{Flow Management at Multi-Gbps: Tradeoffs and Lessons Learned}},
  Author                   = {Nassopulos, Georges and Rossi, Dario and Gringoli, Francesco and Nava, Lorenzo and Dusi, Maurizio and Santiago del Rio, Pedro Maria},
  Booktitle                = {Traffic Monitoring and Analysis: 6th International Workshop, TMA 2014, London, UK, April 14, 2014. Proceedings},
  Year                     = {2014},

  Address                  = {Berlin, Heidelberg},
  Editor                   = {Dainotti, Alberto and Mahanti, Anirban and Uhlig, Steve},
  Pages                    = {1--14},
  Publisher                = {Springer Berlin Heidelberg},

  Doi                      = {10.1007/978-3-642-54999-1_1},
  ISBN                     = {978-3-642-54999-1},
  Owner                    = {velan},
  Timestamp                = {2017.04.28},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-54999-1_1}
}

@Online{NETCOPETechnologies-2017-Modelling,
  Title                    = {{Modelling of High Bandwidth Systems}},
  Author                   = {{NETCOPE Technologies}},
  Url                      = {https://www.netcope.com/getattachment/ecf0b75f-b961-485a-94e1-ee6e1bd7bef4/Modelling-of-High-Bandwidth-Systems.aspx},
  Urldate                  = {2017-11-30},

  Month                    = aug,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.11.30}
}

@Article{Nguyen-2008-Survey,
  Title                    = {{A Survey of Techniques for Internet Traffic Classification Using Machine Learning}},
  Author                   = {Nguyen, Thuy T.T. and Armitage, Grenville},
  Journal                  = {Communications Surveys \& Tutorials, IEEE},
  Year                     = {2008},

  Month                    = oct,
  Number                   = {4},
  Pages                    = {56--76},
  Volume                   = {10},

  Abstract                 = {The research community has begun looking for IP traffic classification techniques that do not rely on `well known¿ TCP or UDP port numbers, or interpreting the contents of packet payloads. New work is emerging on the use of statistical traffic characteristics to assist in the identification and classification process. This survey paper looks at emerging research into the application of Machine Learning (ML) techniques to IP traffic classification - an inter-disciplinary blend of IP networking and data mining techniques. We provide context and motivation for the application of ML techniques to IP traffic classification, and review 18 significant works that cover the dominant period from 2004 to early 2007. These works are categorized and reviewed according to their choice of ML strategies and primary contributions to the literature. We also discuss a number of key requirements for the employment of ML-based traffic classifiers in operational IP networks, and qualitatively critique the extent to which the reviewed works meet these requirements. Open issues and challenges in the field are also discussed.},
  Acmid                    = {2211395},
  Address                  = {Piscataway, NJ, USA},
  Doi                      = {10.1109/SURV.2008.080406},
  ISSN                     = {1553-877X},
  Issue_date               = {October 2008},
  Keywords                 = {Flow clustering, Internet Protocol, Machine Learning, Payload inspection, Real Time, Statistical traffic properties, Traffic classification},
  Numpages                 = {21},
  Owner                    = {velan},
  Publisher                = {IEEE Press},
  Timestamp                = {2014.10.24},
  Url                      = {http://dx.doi.org/10.1109/SURV.2008.080406}
}

@Online{--nProbe,
  Title                    = {{nProbe}},
  Author                   = {{ntop}},
  Url                      = {http://www.ntop.org/products/nprobe/},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Online{--ntop,
  Title                    = {{ntop}},
  Author                   = {{ntop}},
  Url                      = {http://www.ntop.org/products/ntop/},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Online{ntop--PFRING,
  Title                    = {{PF\_RING Zero Copy}},
  Author                   = {ntop},
  Url                      = {https://www.ntop.org/products/packet-capture/pf_ring/pf_ring-zc-zero-copy/},
  Urldate                  = {2018-02-13},

  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Online{ntop-2011-Unveiling,
  Title                    = {{Unveiling Application Visibility in ntop and nProbe (both in NetFlow v9 and IPFIX)}},
  Author                   = {ntop},
  Url                      = {http://www.ntop.org/nprobe/unveiling-application-visibility-in-ntop-and-nprobe-both-in-netflow-v9-and-ipfix/},
  Urldate                  = {2017-09-27},

  Month                    = Nov,
  Year                     = {2011},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@Online{ntop-2010-PFRING,
  Title                    = {{PF\_RING DNA}},
  Author                   = {ntop},
  Url                      = {https://www.ntop.org/pf_ring/introducing-pf_ring-dna-direct-nic-access/},
  Urldate                  = {2018-02-12},

  Month                    = feb,
  Year                     = {2010},

  Owner                    = {velan},
  Timestamp                = {2018.02.12}
}

@InProceedings{Okada-2011-Application,
  Title                    = {{Application Identification from Encrypted Traffic Based on Characteristic Changes by Encryption}},
  Author                   = {Okada, Yohei and Ata, Shingo and Nakamura, Nobuyuki and Nakahira, Yoshihiro and Oka, Ikuo},
  Booktitle                = {Communications Quality and Reliability (CQR), 2011 IEEE International Workshop Technical Committee on},
  Year                     = {2011},
  Month                    = May,
  Pages                    = {1-6},

  Abstract                 = {Application identification is paid much attention by network operators to manage application based traffic control in the Internet. However, encryption is one of the factors to make application identification difficult, because it is so hard to infer the original (unencrypted) packets from encrypted packets. Therefore the accuracy of application identification is getting worse as the increase of encrypted traffic. In this paper, the changes in traffic features due to encryption are analyzed, and two methods are developed that can be used with an existing method for identifying applications from encrypted traffic. Experimental results show that these methods improve identification accuracy up to 28.5\% for encrypted traffic compared to existing methods. Moreover, identification using the best combination of flow features enables high accuracy with less computation due to the elimination of features that do not flow a Gaussian distribution and thus degrade accuracy.},
  Doi                      = {10.1109/CQR.2011.5996087},
  Keywords                 = {Gaussian distribution;Internet;computer network security;cryptography;Gaussian distribution;Internet;application identification;network operators;traffic control;traffic encryption;Accuracy;Correlation;Encryption;Monitoring;Servers;Training data},
  Location                 = {Naples, Florida, USA},
  Owner                    = {velan},
  Review                   = {Authors create training data set for PPTP and IPsec encryptions and HTTP, FTP, SSH, SMTP applications. Then they evaluate which of 49 measured flow features are strongly correlated in normal and encrypted traffic. These features are used to infer functions to describe the relation between the features. The encrypted traffic is separated based on strongly distinct features. Using Naive Bayes classifier with inferred flow fetures on encrypted traffic improves accuracy of the method up to 28.5\%. Moreover, the paper shows that it is possible to recognize encrypted traffic based on flow features. However, this is true for encrypted tunnels, authors do not provide any information about per flow encryption (e.g. using TLS).},
  Timestamp                = {2014.08.25}
}

@Online{OISF-2017-Suricata,
  Title                    = {{Suricata -- network IDS, IPS and network security monitoring engine}},
  Author                   = {{Open Information Security Foundation}},
  Url                      = {http://www.suricata-ids.org},
  Urldate                  = {2017-10-18},

  Month                    = oct,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Online{ONF-2012-OpenFlow,
  Title                    = {{OpenFlow Switch Specification}},
  Author                   = {{Open Networking Foundation}},
  Url                      = {https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.3.1.pdf},
  Urldate                  = {2017-04-27},

  Month                    = sep,
  Year                     = {2012},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Misc{nbar-patent,
  Title                    = {{Intelligent network based application recognition}},

  Author                   = {Ott, Michael},
  Month                    = Nov,
  Note                     = {US Patent 6,961,770},
  Year                     = {2005},

  Keywords                 = {nbar, cisco},
  Owner                    = {Milan},
  Timestamp                = {2014.12.01}
}

@Online{PAN--Next,
  Title                    = {{Next-Generation Firewall}},
  Author                   = {{Palo Alto Networks}},
  Url                      = {https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall},
  Urldate                  = {2017-09-27},

  Owner                    = {velan},
  Timestamp                = {2017.09.27}
}

@InProceedings{Pang-2006-binpac,
  Title                    = {{binpac: A yacc for Writing Application Protocol Parsers}},
  Author                   = {Pang, Ruoming and Paxson, Vern and Sommer, Robin and Peterson, Larry},
  Booktitle                = {Proceedings of the 6th ACM SIGCOMM conference on Internet measurement},
  Year                     = {2006},

  Address                  = {New York, NY, USA},
  Pages                    = {289--300},
  Publisher                = {ACM},
  Series                   = {IMC '06},

  Acmid                    = {1177119},
  Doi                      = {10.1145/1177080.1177119},
  ISBN                     = {1-59593-561-4},
  Keywords                 = {parser generator, protocol},
  Location                 = {Rio de Janeriro, Brazil},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://doi.acm.org/10.1145/1177080.1177119}
}

@Article{Paxson-1999-Bro,
  Title                    = {{Bro: a system for detecting network intruders in real-time}},
  Author                   = {Paxson, Vern},
  Journal                  = {Comput. Netw.},
  Year                     = {1999},

  Month                    = dec,
  Number                   = {23-24},
  Pages                    = {2435--2463},
  Volume                   = {31},

  Acmid                    = {337972},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1016/S1389-1286(99)00112-7},
  ISSN                     = {1389-1286},
  Issue_date               = {Dec. 1999},
  Keywords                 = {domain-specific languages, network intrusion detection, network monitoring evasion, passive network monitoring},
  Numpages                 = {29},
  Owner                    = {velan},
  Publisher                = {Elsevier North-Holland, Inc.},
  Timestamp                = {2017.10.18},
  Url                      = {http://dx.doi.org/10.1016/S1389-1286(99)00112-7}
}

@Article{Paxson-1995-Wide,
  Title                    = {{Wide Area Traffic: The Failure of Poisson Modeling}},
  Author                   = {Paxson, Vern and Floyd, Sally},
  Journal                  = {IEEE/ACM Trans. Netw.},
  Year                     = {1995},

  Month                    = jun,
  Number                   = {3},
  Pages                    = {226--244},
  Volume                   = {3},

  Acmid                    = {208390},
  Address                  = {Piscataway, NJ, USA},
  Doi                      = {10.1109/90.392383},
  ISSN                     = {1063-6692},
  Issue_date               = {June 1995},
  Numpages                 = {19},
  Owner                    = {velan},
  Publisher                = {IEEE Press},
  Timestamp                = {2015.08.05}
}

@Online{scp-description,
  Title                    = {{How the SCP protocol works.} \textit{Jan Pechanec's Weblog.}},
  Author                   = {Pechanec, Jan},
  Url                      = {https://blogs.oracle.com/janp/entry/how_the_scp_protocol_works},
  Urldate                  = {2014-10-30},

  Month                    = Jul,
  Year                     = {2007},

  Abstract                 = {Have you ever wondered how the scp and rcp commands worked? The first time I did I haven't found any documentation on the subject. There is no RFC, no draft, not even README file describing it. After reading the source code I tried again and realized that old version of rcp.c might be really the only original documentation available. And since I worked on a couple of bugs in our scp(1) some time ago I put a note in my todo list to write something about it, for the next time I'm going to need it.},
  Keywords                 = {SCP, description},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03}
}

@InProceedings{Perdisci-2010-Behavioral,
  Title                    = {{Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces}},
  Author                   = {Perdisci, Roberto and Lee, Wenke and Feamster, Nick},
  Booktitle                = {Proceedings of the 7th USENIX Conference on Networked Systems Design and Implementation},
  Year                     = {2010},

  Address                  = {Berkeley, CA, USA},
  Publisher                = {USENIX Association},
  Series                   = {NSDI'10},

  Acmid                    = {1855737},
  Location                 = {San Jose, California},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{Phaal-2004-sFlow,
  Title                    = {{sFlow Version 5}},
  Author                   = {Phaal, Peter},
  Url                      = {http://sflow.org/sflow_version_5.txt},
  Urldate                  = {2017-04-27},
  Year                     = {2004},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Article{Poese-2011-IP,
  Title                    = {{IP Geolocation Databases: Unreliable?}},
  Author                   = {Poese, Ingmar and Uhlig, Steve and Kaafar, Mohamed Ali and Donnet, Benoit and Gueye, Bamba},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2011},

  Month                    = apr,
  Number                   = {2},
  Pages                    = {53--56},
  Volume                   = {41},

  Doi                      = {10.1145/1971162.1971171},
  ISSN                     = {0146-4833},
  Issue_date               = {April 2011},
  Numpages                 = {4},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.10.25}
}

@Book{Provos-2007-Virtual,
  Title                    = {{Virtual Honeypots: From Botnet Tracking to Intrusion Detection}},
  Author                   = {Provos, Niels and Holz, Thorsten},
  Publisher                = {Addison-Wesley Professional},
  Year                     = {2007},
  Edition                  = {First},

  ISBN                     = {9780321336323},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Pus-2015-Hardware,
  Title                    = {{Hardware Accelerated Flow Measurement of 100 Gb Ethernet}},
  Author                   = {Puš, Viktor and Velan, Petr and Kekely, Lukáš and Kořenek, Jan and Minařík, Pavel},
  Booktitle                = {2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)},
  Year                     = {2015},

  Address                  = {Ottawa, Canada},
  Editor                   = {Badonnel, Remi and Xiao, Jin and Ata, Shingo and De Turck, Filip and Groza, Voicu and dos Santos, Carlos Raniery P.},
  Month                    = May,
  Pages                    = {1147-1148},
  Publisher                = {IEEE Xplore Digital Library},

  Abstract                 = {This demo demonstrates results of a joint research project of CESNET and INVEA-TECH focused on 100 GbE network flow monitoring using FPGA. It shows, to the best of our knowledge, the first flow monitoring setup capable of handling fully saturated 100 G Ethernet line. We present COMBO-CG card that provides accurate timestamps for high-resolution traffic monitoring. The card is complemented by fast DMA engine and optimized Linux drivers which were designed and implemented to achieve 100 Gbps data transfers through PCIe bus with low CPU utilization. Network traffic can be distributed among multiple CPU cores based on configurable hash functions. Our flow exporter is able to fully utilize available CPU cores to provide wire-speed performance for processing of the 100 Gbps traffic. The demo will show complete 100 G flow monitoring setup - from packet generator to flow collector.},
  Doi                      = {10.1109/INM.2015.7140452},
  ISSN                     = {1573-0077},
  Keywords                 = {hardware; accelerated; flow monitoring; network monitoring; measurement; 100G; Ethernet},
  Language                 = {eng},
  Location                 = {Ottawa, Canada},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{QoSient--ARGUS,
  Title                    = {{ARGUS - Auditing Network Activity}},
  Author                   = {{QoSient}},
  Url                      = {http://www.qosient.com/argus/argusnetflow.shtml},
  Urldate                  = {2017-10-25},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@Online{Qualys-2017-LibHTP,
  Title                    = {{LibHTP -- security-aware parser for the HTTP protocol}},
  Author                   = {{Qualys, Inc.}},
  Url                      = {http://github.com/ironbee/libhtp},
  Urldate                  = {2017-10-18},

  Month                    = jul,
  Year                     = {2017},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Online{qualys-ssl-fingerprinting,
  Title                    = {{HTTP Client Fingerprinting Using SSL Handshake Analysis}},
  Author                   = {{Qualys, Inc.}},
  Url                      = {https://www.ssllabs.com/projects/client-fingerprinting/},
  Urldate                  = {2014-11-28},
  Year                     = {2014},

  Keywords                 = {SSL, TLS, fingerprinting},
  Owner                    = {Milan},
  Timestamp                = {2014.11.28}
}

@InProceedings{Quan-2010-Characteristics,
  Title                    = {On the Characteristics and Reasons of Long-lived Internet Flows},
  Author                   = {Quan, Lin and Heidemann, John},
  Booktitle                = {Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement},
  Year                     = {2010},

  Address                  = {New York, NY, USA},
  Pages                    = {444--450},
  Publisher                = {ACM},
  Series                   = {IMC '10},

  Acmid                    = {1879198},
  Doi                      = {10.1145/1879141.1879198},
  ISBN                     = {978-1-4503-0483-2},
  Keywords                 = {computer-to-computer communication, long duration flow},
  Location                 = {Melbourne, Australia},
  Numpages                 = {7},
  Owner                    = {velan},
  Timestamp                = {2016.01.06}
}

@InProceedings{Rizzo-2012-Netmap,
  Title                    = {{Netmap: a novel framework for fast packet I/O}},
  Author                   = {Rizzo, Luigi},
  Booktitle                = {21st USENIX Security Symposium (USENIX Security 12)},
  Year                     = {2012},
  Pages                    = {101--112},

  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@InProceedings{Rodriguez-2013-Empirical,
  Title                    = {{Empirical Analysis of Traffic to Establish a Profiled Flow Termination Timeout}},
  Author                   = {Rodriguez, Juan Moliná and Español, Valentín Carela and Ros, Pere Barlet and Hoffmann, Ralf and Degner, Klaus},
  Booktitle                = {2013 9th International Wireless Communications and Mobile Computing Conference (IWCMC)},
  Year                     = {2013},
  Month                    = Jul,
  Pages                    = {1156-1161},

  Doi                      = {10.1109/IWCMC.2013.6583720},
  ISSN                     = {2376-6492},
  Keywords                 = {Internet;mobile radio;pattern classification;radio links;telecommunication traffic;DPI tool;ISP;Internet;computation cost;edge link;heterogeneous applications behaviour;memory reduction;mobile operator;online traffic classification accuracy;profiled flow termination timeout;Accuracy;Engines;Internet;Memory management;Postal services;Protocols;Standards;Traffic classification;classifier optimization;profiled termination timeout},
  Owner                    = {velan},
  Timestamp                = {2017.04.28}
}

@InProceedings{Roesch-1999-Snort,
  Title                    = {{Snort - Lightweight Intrusion Detection for Networks}},
  Author                   = {Roesch, Martin},
  Booktitle                = {{Proceedings of the 13th USENIX conference on System administration}},
  Year                     = {1999},

  Address                  = {Berkeley, CA, USA},
  Pages                    = {229--238},
  Publisher                = {{USENIX Association}},
  Series                   = {LISA '99},

  Acmid                    = {1039864},
  Location                 = {Seattle, Washington},
  Numpages                 = {10},
  Owner                    = {velan},
  Timestamp                = {2017.10.18},
  Url                      = {http://dl.acm.org/citation.cfm?id=1039834.1039864}
}

@InProceedings{Sadre-2012-Effects,
  Title                    = {{The Effects of DDoS Attacks on Flow Monitoring Applications}},
  Author                   = {Sadre, Ramin and Sperotto, Anna and Pras, Aiko},
  Booktitle                = {2012 IEEE Network Operations and Management Symposium},
  Year                     = {2012},
  Month                    = Apr,
  Pages                    = {269-277},

  Doi                      = {10.1109/NOMS.2012.6211908},
  ISSN                     = {1542-1201},
  Keywords                 = {IP networks;computer network management;computer network security;DDoS attack effect;IP network monitoring;dimension flow-based monitoring systems;distributed denial-of-service attacks;flow data;network management;Analytical models;Computer crime;Educational institutions;IP networks;Intrusion detection;Monitoring;Probes},
  Owner                    = {velan},
  Timestamp                = {2017.04.28}
}

@Online{Sandvine-2014-Global,
  Title                    = {{Global Internet Phenomena Report 1H 2014}},
  Author                   = {{Sandvine, Inc.}},
  Url                      = {https://www.sandvine.com/downloads/general/global-internet-phenomena/2014/1h-2014-global-internet-phenomena-report.pdf},
  Urldate                  = {2014-11-25},

  Month                    = may,
  Year                     = {2014},

  Owner                    = {velan},
  Timestamp                = {2014.11.25}
}

@InProceedings{Sarrar-2012-Investigating,
  Title                    = {{Investigating IPv6 Traffic: What Happened at the World IPv6 Day?}},
  Author                   = {Sarrar, Nadi and Maier, Gregor and Ager, Bernhard and Sommer, Robin and Uhlig, Steve},
  Booktitle                = {Proceedings of the 13th International Conference on Passive and Active Measurement},
  Year                     = {2012},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {11--20},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'12},

  Acmid                    = {2238899},
  Doi                      = {10.1007/978-3-642-28537-0_2},
  ISBN                     = {978-3-642-28536-3},
  Location                 = {Vienna, Austria},
  Numpages                 = {10},
  Owner                    = {velan},
  Timestamp                = {2017.10.25},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-28537-0_2}
}

@InProceedings{Schneider-2008-new,
  Title                    = {{The new web: characterizing AJAX traffic}},
  Author                   = {Schneider, Fabian and Agarwal, Sachin and Alpcan, Tansu and Feldmann, Anja},
  Booktitle                = {Proceedings of the 9th international conference on Passive and active network measurement},
  Year                     = {2008},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {31--40},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'08},

  Acmid                    = {1791955},
  ISBN                     = {978-3-540-79231-4},
  Location                 = {Cleveland, OH, USA},
  Numpages                 = {10},
  Url                      = {http://dl.acm.org/citation.cfm?id=1791949.1791955}
}

@Article{Shimeall-2014-Using,
  Title                    = {{Using SiLK for Network Traffic Analysis}},
  Author                   = {Shimeall, Timothy and Faber, Sidney and DeShon, Markus and Kompanek, Andrew},
  Journal                  = {CERT R Network Situational Awareness Group, Carnegie Mellon University},
  Year                     = {2014},

  Owner                    = {jirsik},
  Timestamp                = {2015.12.08},
  Url                      = {http://tools.netsa.cert.org/silk/analysis-handbook.pdf}
}

@Online{Sima-2013-FlowMon,
  Title                    = {{FlowMon -- Plugins for HTTP Monitoring}},
  Author                   = {Šíma, Tomáš and Velan, Petr and Čeleda, Pavel},
  Url                      = {http://dior.ics.muni.cz/~velan/flowmon-input-http/},
  Urldate                  = {2017-10-18},

  Month                    = apr,
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Article{Singh-2017-Survey,
  Title                    = {{A Survey on Software Defined Networking: Architecture for Next Generation Network}},
  Author                   = {Singh, Sanjeev and Jha, Rakesh Kumar},
  Journal                  = {J. Netw. Syst. Manage.},
  Year                     = {2017},

  Month                    = apr,
  Number                   = {2},
  Pages                    = {321--374},
  Volume                   = {25},

  Acmid                    = {3058163},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1007/s10922-016-9393-9},
  ISSN                     = {1064-7570},
  Issue_date               = {April 2017},
  Keywords                 = {Control plane, Data plane, Generalized multi-protocol label switching, OpenFlow, Software defined heterogeneous network, Standard development organizations},
  Numpages                 = {54},
  Owner                    = {velan},
  Publisher                = {Plenum Press},
  Timestamp                = {2017.04.27},
  Url                      = {https://doi.org/10.1007/s10922-016-9393-9}
}

@Online{skype-web,
  Title                    = {{Skype}},
  Author                   = {{Skype and Microsoft}},
  Url                      = {http://www.skype.com/},
  Urldate                  = {2014-11-25},
  Year                     = {2014},

  Keywords                 = {skype, home page},
  Owner                    = {Milan},
  Timestamp                = {2014.12.03}
}

@Online{skype-requirements,
  Title                    = {{Skype Connect™ Requirements Guide}},
  Author                   = {{Skype Limited}},
  Url                      = {http://download.skype.com/share/business/guides/skype-connect-requirements-guide.pdf},
  Urldate                  = {2014-11-01},
  Year                     = {2011},

  Keywords                 = {Skype, Requirements Guide},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03}
}

@InProceedings{Sommer-2016-Spicy,
  Title                    = {{Spicy: A Unified Deep Packet Inspection Framework for Safely Dissecting All Your Data}},
  Author                   = {Sommer, Robin and Amann, Johanna and Hall, Seth},
  Booktitle                = {Proceedings of the 32Nd Annual Conference on Computer Security Applications},
  Year                     = {2016},

  Address                  = {New York, NY, USA},
  Pages                    = {558--569},
  Publisher                = {ACM},
  Series                   = {ACSAC '16},

  Acmid                    = {2991100},
  Doi                      = {10.1145/2991079.2991100},
  ISBN                     = {978-1-4503-4771-6},
  Location                 = {Los Angeles, California, USA},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2017.08.25},
  Url                      = {http://doi.acm.org/10.1145/2991079.2991100}
}

@InProceedings{Sommer-2010-Outside,
  Title                    = {{Outside the Closed World: On Using Machine Learning for Network Intrusion Detection}},
  Author                   = {Sommer, Robin and Paxson, Vern},
  Booktitle                = {2010 IEEE Symposium on Security and Privacy},
  Year                     = {2010},
  Month                    = May,
  Pages                    = {305-316},

  Doi                      = {10.1109/SP.2010.25},
  ISSN                     = {1081-6011},
  Keywords                 = {Computer science;Computer security;Computerized monitoring;Guidelines;Intrusion detection;Laboratories;Machine learning;National security;Privacy;Telecommunication traffic;anomaly detection;intrusion detection;machine learning;network security},
  Owner                    = {velan},
  Timestamp                = {2017.08.09}
}

@InProceedings{Song-2005-Efficient,
  Title                    = {{Efficient Packet Classification for Network Intrusion Detection Using FPGA}},
  Author                   = {Song, Haoyu and Lockwood, John W.},
  Booktitle                = {Proceedings of the 2005 ACM/SIGDA 13th International Symposium on Field-programmable Gate Arrays},
  Year                     = {2005},

  Address                  = {New York, NY, USA},
  Pages                    = {238--245},
  Publisher                = {ACM},
  Series                   = {FPGA '05},

  Acmid                    = {1046223},
  Doi                      = {10.1145/1046192.1046223},
  ISBN                     = {1-59593-029-9},
  Keywords                 = {BV, FPGA, NIDS, TCAM, packet classification, reconfigurable hardware, tree bitmap},
  Location                 = {Monterey, California, USA},
  Numpages                 = {8},
  Owner                    = {velan},
  Timestamp                = {2018.02.20},
  Url                      = {http://doi.acm.org/10.1145/1046192.1046223}
}

@Article{Sperotto-2010-Overview,
  Title                    = {{An Overview of IP Flow-Based Intrusion Detection}},
  Author                   = {Sperotto, Anna and Schaffrath, Gregor and Sadre, Ramin and Morariu, Cristian and Pras, Aiko and Stiller, Burkhard},
  Journal                  = {Communications Surveys Tutorials, IEEE},
  Year                     = {2010},

  Month                    = apr,
  Number                   = {3},
  Pages                    = {343-356},
  Volume                   = {12},

  ISSN                     = {1553-877X},
  Keywords                 = {IP networks;computer network security;data flow analysis;invasive software;Botnets;DoS attacks;IP flow based intrusion detection;data flow;packet inspection;worms;Botnets;DoS;Network flows;attacks;intrusion detection;scan;worms},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{ssl-certificates-blacklist,
  Title                    = {{SSL Blacklist}},
  Author                   = {{sslbl.abuse.ch}},
  Url                      = {https://sslbl.abuse.ch/},
  Urldate                  = {2014-11-28},
  Year                     = {2014},

  Keywords                 = {SSL, blacklist, certificate},
  Owner                    = {Milan},
  Timestamp                = {2014.11.28}
}

@Article{ssh-basics,
  Title                    = {{Protocol Basics: Secure Shell Protocol}},
  Author                   = {Stallings, William},
  Journal                  = {The Internet Protocol Journal},
  Year                     = {2009},

  Month                    = Dec,
  Number                   = {4},
  Pages                    = {18--30},
  Volume                   = {12},

  Keywords                 = {SSH, Cisco journal, Secure Shell Protocol},
  Owner                    = {Milan},
  Timestamp                = {2014.11.03},
  Url                      = {http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_12-4/124_ssh.html}
}

@InProceedings{Steinberger-2013-Anomaly,
  Title                    = {{Anomaly Detection and Mitigation at Internet Scale: A Survey}},
  Author                   = {Steinberger, Jessica and Schehlmann, Lisa and Abt, Sebastian and Baier, Harald},
  Booktitle                = {Proceedings of the 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security: Emerging Management Mechanisms for the Future Internet - Volume 7943},
  Year                     = {2013},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {49--60},
  Publisher                = {Springer-Verlag},
  Series                   = {AIMS'13},

  Acmid                    = {2525033},
  Doi                      = {10.1007/978-3-642-38998-6_7},
  ISBN                     = {978-3-642-38997-9},
  Keywords                 = {anomaly detection, anomaly mitigation, correlation, internet service provider, netflow, network security},
  Location                 = {Barcelona, Spain},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.03.02},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-38998-6_7}
}

@InProceedings{Suarez-Varela-2017-Towards,
  Title                    = {{Towards a NetFlow Implementation for OpenFlow Software-Defined Networks}},
  Author                   = {Suárez-Varela, José and Barlet-Ros, Pere},
  Booktitle                = {2017 29th International Teletraffic Congress (ITC 29)},
  Year                     = {2017},
  Month                    = Sep,
  Pages                    = {187-195},
  Volume                   = {1},

  Doi                      = {10.23919/ITC.2017.8064355},
  Keywords                 = {IP networks;software defined networking;telecommunication traffic;IPFIX;Internet Protocol Flow Information Export;NetFlow implementation;Open vSwitch;OpenDaylight;OpenFlow software-defined networks;OpenFlow switches;concurrent flows;flow monitoring rules;flow tables;flow-level measurements;traffic sampling;Control systems;Monitoring;Pipelines;Protocols;Sampling methods;Scalability;Network measurements;OpenFlow;Software-Defined Networks},
  Owner                    = {velan},
  Timestamp                = {2018.01.31}
}

@InProceedings{Sun-2010-Novel,
  Title                    = {{An Novel Hybrid Method for Effectively Classifying Encrypted Traffic}},
  Author                   = {Sun, Guang-Lu and Xue, Yibo and Dong, Yingfei and Wang, Dongsheng and Li, Chenglong},
  Booktitle                = {Global Telecommunications Conference (GLOBECOM 2010), 2010 IEEE},
  Year                     = {2010},
  Month                    = Dec,
  Pages                    = {1-5},

  Abstract                 = {Classifying encrypted traffic is critical to effective network analysis and management. While traditional payload- based methods are powerless to deal with encrypted traffic, machine learning methods have been proposed to address this issue. However, these methods often bring heavy overhead into the system. In this paper, we propose a hybrid method that combines signature-based methods and statistical analysis methods to address this issue. We first identify SSL/TLS traffic with signature matching methods, and then apply statistical analysis to determine concrete application protocols. Our experimental results show that the proposed method is able to recognize over 99\% of SSL/TLS traffic and achieve 94.52\% in F-score for protocols identification.},
  Doi                      = {10.1109/GLOCOM.2010.5683649},
  ISSN                     = {1930-529X},
  Keywords                 = {cryptography;learning (artificial intelligence);statistical analysis;telecommunication computing;telecommunication network management;telecommunication security;telecommunication traffic;SSL-TLS traffic;encrypted traffic;machine learning;network analysis;network management;payload- based method;signature matching method;signature-based method;statistical analysis;Accuracy;Bayesian methods;Computational modeling;Cryptography;Protocols;Statistical analysis;Training},
  Location                 = {Miami, Florida, USA},
  Owner                    = {velan},
  Review                   = {The paper describes a hybrid method for encrypted traffic classification. SSL/TLS is identified first based on signature matching, then HTTP, TOR and other traffic is distinguished using Naive Bayesian classification method. The paper provides an overview of statistical and packet based classification methods, which could be useful for writing further papers in this area.},
  Timestamp                = {2014.07.08}
}

@InProceedings{Sun-2010-Ethicality,
  Title                    = {{The Ethicality of Web Crawlers}},
  Author                   = {Sun, Yang and Councill, Isaac G. and Giles, C. Lee},
  Booktitle                = {{Web Intelligence and Intelligent Agent Technology (WI-IAT), 2010 IEEE/WIC/ACM International Conference on}},
  Year                     = {2010},
  Month                    = Aug,
  Pages                    = {668--675},
  Volume                   = {1},

  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{IESG--Packet,
  Title                    = {{Packet Sampling Charter}},
  Author                   = {{The Internet Engineering Steering Group}},
  Url                      = {https://datatracker.ietf.org/doc/charter-ietf-psamp/},
  Urldate                  = {2017-04-27},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{IETF--IP,
  Title                    = {{IP Flow Information Export (ipfix) Charter}},
  Author                   = {{The Internet Engineering Steering Group}},
  Url                      = {http://datatracker.ietf.org/wg/ipfix/charter/},
  Urldate                  = {2017-04-27},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{IESG-2001-IP,
  Title                    = {{IP Flow Information Export Charter}},
  Author                   = {{The Internet Engineering Steering Group}},
  Url                      = {https://www.ietf.org/mail-archive/web/ipfix/current/msg00213.html},
  Urldate                  = {2017-04-27},

  Month                    = sep,
  Year                     = {2001},

  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{IESG-1997-IP,
  Title                    = {{IP Performance Measurement (ippm)}},
  Author                   = {{The Internet Engineering Steering Group}},
  Url                      = {https://datatracker.ietf.org/wg/ippm/},
  Urldate                  = {2017-11-29},

  Month                    = oct,
  Year                     = {1997},

  Owner                    = {velan},
  Timestamp                = {2017.11.29}
}

@Online{IESG-1989-Benchmarking,
  Title                    = {{Benchmarking Methodology (bmwg)}},
  Author                   = {{The Internet Engineering Steering Group}},
  Url                      = {https://datatracker.ietf.org/wg/bmwg/},
  Urldate                  = {2018-02-09},

  Month                    = oct,
  Year                     = {1989},

  Owner                    = {velan},
  Timestamp                = {2018.02.09}
}

@InProceedings{Torres-2012-Identifying,
  Title                    = {{Identifying Sessions to Websites as an Aggregation of Related Flows}},
  Author                   = {Torres, Luis Miguel and Magana, Eduardo and Izal, Mikel and Morato, Daniel},
  Booktitle                = {Telecommunications Network Strategy and Planning Symposium (NETWORKS), 2012 XVth International},
  Year                     = {2012},
  Pages                    = {1-6},

  Doi                      = {10.1109/NETWKS.2012.6381703},
  Keywords                 = {Web services;peer-to-peer computing;social networking (online);telecommunication traffic;video streaming;HTTP;Netflow-type record;Web sites;Web-based service;network traffic;online newspaper;social network;traffic classification;video streaming;webmail;Browsers;Electronic mail;IP networks;Servers;Streaming media;YouTube;clustering methods;web and Internet services;web mining;web sites},
  Owner                    = {velan},
  Timestamp                = {2017.10.18}
}

@Article{Torres-2012-Strategies,
  Title                    = {{Strategies for automatic labelling of web traffic traces}},
  Author                   = {Torres, Luis Miguel and Magana, Eduardo and Izal, Mikel and Morato, Daniel},
  Journal                  = {37th Annual IEEE Conference on Local Computer Networks},
  Year                     = {2012},
  Pages                    = {196-199},
  Volume                   = {0},

  Address                  = {Los Alamitos, CA, USA},
  Doi                      = {http://doi.ieeecomputersociety.org/10.1109/LCN.2012.6423605},
  ISSN                     = {0742-1303},
  Owner                    = {velan},
  Publisher                = {IEEE Computer Society},
  Timestamp                = {2017.10.18}
}

@Article{Trammell-2011-Introduction,
  Title                    = {{An Introduction to IP Flow Information Export (IPFIX)}},
  Author                   = {Trammell, Brian and Boschi, Elisa},
  Journal                  = {IEEE Communications Magazine},
  Year                     = {2011},

  Month                    = Apr,
  Number                   = {4},
  Pages                    = {89-95},
  Volume                   = {49},

  Doi                      = {10.1109/MCOM.2011.5741152},
  ISSN                     = {0163-6804},
  Keywords                 = {IP networks;protocols;Cisco NetFlow version 9;IP flow information export;IP networks;IPFIX;network management;network monitoring;protocol;Data models;Delay;Layout;Monitoring;Reliability;Transport protocols},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@Online{Trojnar-2015-Stunnel,
  Title                    = {{Stunnel}},
  Author                   = {Trojnara, Michał},
  Url                      = {https://www.stunnel.org/index.html},
  Urldate                  = {2017-08-03},

  Month                    = jul,
  Year                     = {2015},

  Owner                    = {thorgrin},
  Timestamp                = {2017.08.03}
}

@Article{Tsai-2009-Intrusion,
  Title                    = {{Intrusion detection by machine learning: A review}},
  Author                   = {Tsai, Chih-Fong and Hsu, Yu-Feng and Lin, Chia-Ying and Lin, Wei-Yang},
  Journal                  = {Expert Systems with Applications},
  Year                     = {2009},
  Number                   = {10},
  Pages                    = {11994 - 12000},
  Volume                   = {36},

  Doi                      = {http://dx.doi.org/10.1016/j.eswa.2009.05.029},
  ISSN                     = {0957-4174},
  Keywords                 = {Intrusion detection},
  Owner                    = {velan},
  Timestamp                = {2017.08.09},
  Url                      = {http://www.sciencedirect.com/science/article/pii/S0957417409004801}
}

@Article{Umer-2017-Flow,
  Title                    = {{Flow-based intrusion detection: Techniques and challenges}},
  Author                   = {Muhammad Fahad Umer and Muhammad Sher and Yaxin Bi},
  Journal                  = {Computers \& Security},
  Year                     = {2017},
  Pages                    = {238 - 254},
  Volume                   = {70},

  Doi                      = {http://dx.doi.org/10.1016/j.cose.2017.05.009},
  ISSN                     = {0167-4048},
  Keywords                 = {Network flows},
  Owner                    = {velan},
  Timestamp                = {2017.08.09},
  Url                      = {http://www.sciencedirect.com/science/article/pii/S0167404817301165}
}

@Online{UniversityWaikato--Dag,
  Title                    = {{The Dag Project}},
  Author                   = {{University of Waikato}},
  Url                      = {http://dag.cs.waikato.ac.nz/},
  Urldate                  = {2018-02-10},

  Owner                    = {velan},
  Timestamp                = {2018.02.10}
}

@InProceedings{vanPolen-2011-Finding,
  Title                    = {{Finding and Analyzing Evil Cities on the Internet}},
  Author                   = {{van Polen}, G.T. Matthijs and {Moreira Moura}, Giovane César and Pras, Aiko},
  Booktitle                = {Proceedings of the 5th International Conference on Autonomous Infrastructure, Management and Security (AIMS)},
  Year                     = {2011},
  Pages                    = {38--48},
  Series                   = {{Notes in Computer Science}},
  Volume                   = {6734},

  Owner                    = {velan},
  Timestamp                = {2017.10.25}
}

@InProceedings{Velan-2013-Practical,
  Title                    = {{Practical Experience with IPFIX Flow Collectors}},
  Author                   = {Velan, Petr},
  Booktitle                = {IFIP/IEEE International Symposium on Integrated Network Management (IM 2013)},
  Year                     = {2013},

  Address                  = {Ghent, Belgium},
  Editor                   = {De Turck, Filip and Diao, Yixin and Se on Hong, Choong and Medhi, Deep and Sadre, Ramin},
  Month                    = May,
  Pages                    = {1021-1026},
  Publisher                = {IEEE Xplore Digital Library},

  Abstract                 = {As the number of Internet applications grows, the number of applications that use data encapsulation increases as well. Flow monitoring using NetFlow version 5 or 9 is only able to analyze the encapsulating protocol, therefore it becomes too limited to detect new threats. For this reason, more thorough knowledge of such traffic is needed. The IPFIX protocol can be used in such situations, because it provides enough flexibility for monitoring tools to be extended by new elements. Along with greater flexibility, IPFIX support results in a higher performance footprint on collectors and tools for querying the collected data. Currently, there is a lack of flow collection frameworks with IPFIX support that would allow flow data to be extended. The aim of this paper is to compare open-source flow collectors that provide support for the IPFIX protocol. We focus on evaluating performance of query tools and the level of IPFIX support provided by the collection frameworks.},
  ISBN                     = {978-1-4673-5229-1},
  Keywords                 = {IPFIX; IPFIX support; collector; nfdump; SiLK; IPFIXcol; flow; NetFlow; query performance},
  Location                 = {Ghent, Belgium},
  Owner                    = {velan},
  Timestamp                = {2014.04.23},
  Url                      = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6573125}
}

@InProceedings{Velan-2018-Improving,
  Title                    = {{Improving Network Flow Definition: Formalization and Applicability}},
  Author                   = {Velan, Petr},
  Booktitle                = {NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium},
  Year                     = {2018},
  Pages                    = {Accepted for publication, 5 pages},

  Abstract                 = {Network flow monitoring has been used for more than 20 years and has become an important part of network accounting and security. A significant effort was invested into the standardization of flow monitoring by the Internet Engineering Task Force (IETF). The flow monitoring has steadily evolved to satisfy new requirements created by the demand for increased visibility and accuracy. Therefore, it is not surprising that even the most recent flow definition created by the IETF does not consider several specifics of the flow monitoring process as it is used nowadays. This paper presents a revised flow definition that is more generic and is designed to accommodate more specific flow monitoring requirements. Moreover, we formalize our definition to avoid ambiguity and imprecision introduced by the use of natural language. One additional benefit of formalizing the flow definition is that it implicitly describes the flow creation process as well.},
  Keywords                 = {network;flow;formal;definition},
  Owner                    = {velan},
  Timestamp                = {2018.01.31}
}

@InProceedings{Velan-2016-EventFlow,
  Title                    = {{EventFlow: Network Flow Aggregation Based on User Actions}},
  Author                   = {Velan, Petr},
  Booktitle                = {NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium},
  Year                     = {2016},
  Month                    = Apr,
  Pages                    = {767-771},

  Doi                      = {10.1109/NOMS.2016.7502895},
  Keywords                 = {telecommunication network management;telecommunication traffic;DNS;EventFlow;HTTP;ISP network;flow measurement;flow visibility;network flow monitoring;network traffic;semantic;web page;IP networks;Monitoring;Ports (Computers);Protocols;Prototypes;Uniform resource locators;Web pages},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@InProceedings{Velan-2014-Next,
  Title                    = {{Next Generation Application-Aware Flow Monitoring}},
  Author                   = {Velan, Petr and Čeleda, Pavel},
  Booktitle                = {Monitoring and Securing Virtualized Networks and Services},
  Year                     = {2014},
  Editor                   = {Sperotto, Anna and Doyen, Guillaume and Latré, Steven and Charalambides, Marinos and Stiller, Burkhard},
  Pages                    = {173-178},
  Publisher                = {Springer Berlin Heidelberg},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {8508},

  Abstract                 = {Deep packet inspection (DPI) and IP flow monitoring are frequently used network monitoring approaches. Although the DPI provides application visibility, detailed examination of every packet is computationally intensive. The IP flow monitoring achieves high performance by processing only packet headers, but provides less details about the traffic itself. Application-aware flow monitoring is proposed as an attempt to combine DPI accuracy and IP flow monitoring performance. However, the impacts, benefits and disadvantages of application flow monitoring have not been studied in detail yet. The work proposed in this paper attempts to rectify this lack of research. We also propose a next generation flow measurement for application monitoring. The flows will represent events within the application protocol, e.g., web page download, instead of packet stream. Finally, we will investigate the performance of different approaches to application classification and application parsing with a computational complexity in mind.},
  Doi                      = {10.1007/978-3-662-43862-6_20},
  ISBN                     = {978-3-662-43861-9},
  ISSN                     = {0302-9743},
  Keywords                 = {flow; network measurement; application monitoring; IPFIX},
  Language                 = {English},
  Owner                    = {velan},
  Timestamp                = {2014.08.23},
  Url                      = {http://dx.doi.org/10.1007/978-3-662-43862-6_20}
}

@Article{Velan-2015-Survey,
  Title                    = {{A Survey of Methods for Encrypted Traffic Classification and Analysis}},
  Author                   = {Velan, Petr and Čermák, Milan and Čeleda, Pavel and Drašar, Martin},
  Journal                  = {International Journal of Network Management},
  Year                     = {2015},
  Number                   = {5},
  Pages                    = {355--374},
  Volume                   = {25},

  Abstract                 = {With the widespread use of encrypted data transport, network traffic encryption is becoming a standard nowadays. This presents a challenge for traffic measurement, especially for analysis and anomaly detection methods, which are dependent on the type of network traffic. In this paper, we survey existing approaches for classification and analysis of encrypted traffic. First, we describe the most widespread encryption protocols used throughout the Internet. We show that the initiation of an encrypted connection and the protocol structure give away much information for encrypted traffic classification and analysis. Then, we survey payload and feature-based classification methods for encrypted traffic and categorize them using an established taxonomy. The advantage of some of described classification methods is the ability to recognize the encrypted application protocol in addition to the encryption protocol. Finally, we make a comprehensive comparison of the surveyed feature-based classification methods and present their weaknesses and strengths.},
  Doi                      = {10.1002/nem.1901},
  Keywords                 = {encrypted traffic, monitoring, network, traffic classification, traffic analysis, machine learning, encryption protocols},
  Owner                    = {velan},
  Timestamp                = {2016.01.18},
  Url                      = {http://dx.doi.org/10.1002/nem.1901}
}

@InProceedings{Velan-2013-Design,
  Title                    = {{Design and Evaluation of HTTP Protocol Parsers for IPFIX Measurement}},
  Author                   = {Velan, Petr and Jirs\'{i}k, Tom\'{a}\v{s} and \v{C}eleda, Pavel},
  Booktitle                = {Advances in Communication Networking},
  Year                     = {2013},

  Address                  = {Heidelberg},
  Editor                   = {Thomas Bauschert},
  Pages                    = {136-147},
  Publisher                = {Springer Berlin Heidelberg},
  Volume                   = {8115},

  Abstract                 = {In this paper we analyze HTTP protocol parsers that provide a web traffic visibility to IP flow. Despite extensive work, flow meters generally fall short of performance goals due to extracting application layer data. Constructing effective protocol parser for in-depth analysis is a challenging and error-prone affair. We designed and evaluated several HTTP protocol parsers representing current state-of-the-art approaches used in today’s flow meters. We show the packet rates achieved by respective parsers, including the throughput decrease (performance implications of application parser) which is of the utmost importance for high-speed deployments. We believe that these results provide researchers and network operators with important insight into application visibility and IP flow.},
  Doi                      = {10.1007/978-3-642-40552-5_13},
  ISBN                     = {978-3-642-40551-8},
  Keywords                 = {HTTP; protocol; parser; traffic; measurement; flow; IPFIX},
  Location                 = {Heidelberg},
  Owner                    = {velan},
  Timestamp                = {2014.04.23},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-40552-5_13}
}

@InProceedings{Velan-2012-Flow,
  Title                    = {{Flow Information Storage Assessment Using IPFIXcol}},
  Author                   = {Velan, Petr and Krejčí, Radek},
  Booktitle                = {Dependable Networks and Services},
  Year                     = {2012},

  Address                  = {Heidelberg},
  Editor                   = {Sadre, Ramin and Novotný, Jiří and Čeleda, Pavel and Waldburger, Martin and Stiller, Burkhard},
  Pages                    = {155-158},
  Publisher                = {Springer Berlin Heidelberg},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {7279},

  Abstract                 = {Network monitoring has became a significant part of network management. Each environment and type of network have their specific, different needs. To allow network traffic monitoring in various environments, a necessity of flexible approach thus grows. The current generation of flow collectors provides only a limited flexibility, mainly due to limits of their data storage formats. Moreover, it is quite a challenging task to compare particular storage formats and their suitability for the specific environment and usage. In this paper we present IPFIXcol – a flow collector framework designed for easy data storage formats changing. This way, we plan to evaluate performance and suitability of various data storage formats for specific tasks. Results can be used to build the most appropriate data storage for the specific production environments.},
  Doi                      = {10.1007/978-3-642-30633-4_21},
  ISBN                     = {978-3-642-30632-7},
  Keywords                 = {collector;flow;IPFIX;NetFlow;network monitoring},
  Location                 = {Heidelberg},
  Owner                    = {velan},
  Timestamp                = {2014.04.23},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-30633-4_21}
}

@InProceedings{Velan-2016-Network,
  Title                    = {{Network Traffic Characterisation Using Flow-Based Statistics}},
  Author                   = {Velan, Petr and Medková, Jana and Jirsík, Tomáš and P. Čeleda},
  Booktitle                = {NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium},
  Year                     = {2016},
  Month                    = Apr,
  Pages                    = {907-912},

  Abstract                 = {Performing research on live network traffic requires the traffic to be well documented and described. The results of such research are heavily dependent on the particular network. This paper presents a study of network characteristics, which can be used to describe the behaviour of a network. We propose a number of characteristics that can be collected from the networks and evaluate them on five different networks of Masaryk University. The proposed characteristics cover IP, transport and application layers of the network traffic. Moreover, they reflect strong day-night and weekday patterns that are present in most of the networks. Variation in the characteristics between the networks indicates that they can be used for the description and differentiation of the networks. Furthermore, a weak correlation between the chosen characteristics implies their independence and contribution to network description.},
  Doi                      = {10.1109/NOMS.2016.7502924},
  Keywords                 = {IP networks;telecommunication traffic;IP network;Masaryk University;application layer;flow-based statistics;network traffic characterisation;transport layer;Computer vision;Computers;IP networks;Image motion analysis;Monitoring;Ports (Computers);Servers},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@InProceedings{Velan-2015-High,
  Title                    = {{High-Density Network Flow Monitoring}},
  Author                   = {Velan, Petr and Puš, Viktor},
  Booktitle                = {2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)},
  Year                     = {2015},
  Month                    = May,
  Pages                    = {996-1001},

  Abstract                 = {Monitoring of high-speed networks is becoming a resource intensive task. There are dedicated flow monitoring probes built with commodity hardware support up to 10G links, but multiple 10G or even 100 G optical networks are being used for transport networks and a data center connectivity. Running and maintaining many separate probes is uneconomical and time-consuming. Therefore, we explore the possibility to facilitate network interface cards (NICs) with multiple 10G interfaces to build probes which can replace many existing boxes, leading to reduced management and operational costs. The monitoring performance is critical for such a high-density solution. We use two custom-built, FPGA-based NICs, each with eight 10G interfaces to test current CPU limits and to propose improvements for the near future commodity NICs.},
  Doi                      = {10.1109/INM.2015.7140424},
  ISSN                     = {1573-0077},
  Keywords                 = {computer centres;cost reduction;field programmable gate arrays;network interfaces;optical fibre networks;FPGA-based NIC;data center connectivity;high-density network flow monitoring;management cost reduction;network interface cards;operational cost reduction;optical networks;resource intensive task;transport networks;Hardware;Instruction sets;Monitoring;Probes;Random access memory;Throughput},
  Owner                    = {velan},
  Timestamp                = {2017.04.27}
}

@InProceedings{Verde-2014-No,
  Title                    = {{No NAT'd User Left Behind: Fingerprinting Users behind NAT from NetFlow Records Alone}},
  Author                   = {Verde, Nino Vincenzo and Ateniese, Giuseppe and Gabrielli, Emanuele and Mancini, Luigi Vincezo and Spognardi Angelo},
  Booktitle                = {2014 IEEE 34th International Conference on Distributed Computing Systems},
  Year                     = {2014},
  Month                    = Jun,
  Pages                    = {218-227},

  Doi                      = {10.1109/ICDCS.2014.30},
  ISSN                     = {1063-6927},
  Keywords                 = {Internet;biometrics (access control);data privacy;digital signatures;metropolitan area networks;telecommunication traffic;wireless LAN;NAT user;Net Flow analysis;Net Flow records;biometric signature;distributed network;masked IP addresses;metropolitan WiFi network;network address translation techniques;user fingerprinting framework;user network traffic;user privacy;Hidden Markov models;IP networks;Internet;Monitoring;Payloads;Protocols;Training},
  Owner                    = {velan},
  Timestamp                = {2017.08.09}
}

@InProceedings{Vratonjic-2013-Inconvenient,
  Title                    = {{The Inconvenient Truth About Web Certificates}},
  Author                   = {Vratonjic, Nevena and Freudiger, Julien and Bindschaedler, Vincent and Hubaux, Jean-Pierre},
  Booktitle                = {Economics of Information Security and Privacy III},
  Year                     = {2013},

  Address                  = {New York, NY},
  Editor                   = {Schneier, Bruce},
  Pages                    = {79--117},
  Publisher                = {Springer New York},

  Abstract                 = {HTTPS is the de facto standard for securing Internet communications. Although it is widely deployed, the security provided with HTTPS in practice is dubious. HTTPS may fail to provide security for multiple reasons, mostly due to certificate-based authentication failures. Given the importance of HTTPS, we investigate the current scale and practices of HTTPS and certificate-based deployment. We provide a large-scale empirical analysis that considers the top one million most popular websites. Our results show that very few websites implement certificate-based authentication properly. In most cases, domain mismatches between certificates and websites are observed. We study the economic, legal and social aspects of the problem. We identify causes and implications of the profit-oriented attitude of CAs and show how the current economic model leads to the distribution of cheap certificates for cheap security. Finally, we suggest possible changes to improve certificate-based authentication.},
  ISBN                     = {978-1-4614-1981-5},
  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@InBook{Vykopal-2013-Flow,
  Title                    = {{Flow-based Brute-force Attack Detection}},
  Author                   = {Vykopal, Jan and Dra\v{s}ar, Martin and Winter, Philipp},
  Editor                   = {Markus Zeilinger, Peter Schoo, Eckehard Hermann},
  Pages                    = {41-51},
  Publisher                = {Fraunhofer Verlag},
  Year                     = {2013},

  Address                  = {Stuttgart},

  Booktitle                = {{Advances in IT Early Warning}},
  ISBN                     = {978-3-8396-0474-8},
  Keywords                 = {network; flow; brute force attack; password; detection; similarity; entropy; evasion},
  Language                 = {eng},
  Location                 = {Stuttgart},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InProceedings{Wang-2011-Memory,
  Title                    = {{Memory-Efficient Hypercube Flow Table for Packet Processing on Multi-Cores}},
  Author                   = {Wang, Dawei and Xue, Yibo and Dong, Yingfei},
  Booktitle                = {2011 IEEE Global Telecommunications Conference - GLOBECOM 2011},
  Year                     = {2011},
  Month                    = Dec,
  Pages                    = {1-6},

  Doi                      = {10.1109/GLOCOM.2011.6134338},
  ISSN                     = {1930-529X},
  Keywords                 = {file organisation;hypercube networks;multiprocessing systems;HFT;Intel Xeon E5504 processor;flow-based traffic processing;memory-efficient hypercube flow table;multicore system;multidimension hash table;packet processing;parallel processing;traffic classification;Delay;Hypercubes;IEEE Communications Society;IP networks;Multicore processing;Parallel processing;Servers},
  Owner                    = {velan},
  Timestamp                = {2017.04.28}
}

@InProceedings{Wang-2016-Comparison,
  Title                    = {{Comparison of High-Performance Packet Processing Frameworks on NUMA}},
  Author                   = {Wang, Haipeng and He, Dazhong and Wang, Huan},
  Booktitle                = {2016 7th IEEE International Conference on Software Engineering and Service Science (ICSESS)},
  Year                     = {2016},
  Month                    = aug,
  Pages                    = {54-58},

  Doi                      = {10.1109/ICSESS.2016.7883014},
  Keywords                 = {memory architecture;multi-threading;multiprocessing systems;resource allocation;DPDK;NUMA;PF_RING;high-performance packet processing frameworks;high-speed packet processing frameworks;load balancing model;multicore platforms;multithreading;nonuniform memory access architecture;pipeline model;run-to-completion model;Instruction sets;Multicore processing;Receivers;Testing;DPDK;NUMA;PF RING;load balance;performance;pipeline;run to completion},
  Owner                    = {velan},
  Timestamp                = {2018.02.13}
}

@Article{Wang-2014-Internet,
  Title                    = {{Internet traffic clustering with side information}},
  Author                   = {Wang, Yu and Xiang, Yang and Zhang, Jun and Zhou, Wanlei and Xie, Bailin},
  Journal                  = {Journal of Computer and System Sciences},
  Year                     = {2014},
  Note                     = {Special Issue on Dependable and Secure Computing The 9th \{IEEE\} International Conference on Dependable, Autonomic and Secure Computing },
  Number                   = {5},
  Pages                    = {1021 - 1036},
  Volume                   = {80},

  Abstract                 = {Abstract Internet traffic classification is a critical and essential functionality for network management and security systems. Due to the limitations of traditional port-based and payload-based classification approaches, the past several years have seen extensive research on utilizing machine learning techniques to classify Internet traffic based on packet and flow level characteristics. For the purpose of learning from unlabeled traffic data, some classic clustering methods have been applied in previous studies but the reported accuracy results are unsatisfactory. In this paper, we propose a semi-supervised approach for accurate Internet traffic clustering, which is motivated by the observation of widely existing partial equivalence relationships among Internet traffic flows. In particular, we formulate the problem using a Gaussian Mixture Model (GMM) with set-based equivalence constraint and propose a constrained Expectation Maximization (EM) algorithm for clustering. Experiments with real-world packet traces show that the proposed approach can significantly improve the quality of resultant traffic clusters. },
  Doi                      = {http://dx.doi.org/10.1016/j.jcss.2014.02.008},
  ISSN                     = {0022-0000},
  Keywords                 = {Traffic classification},
  Owner                    = {velan},
  Review                   = {The paper presents an idea that flows with same protocol, destination IP and destination port are most likely carrying the same application. Authors formulate a constrained clustering problem with the classic Gaussian Mixture Mode and apply a varion of the Expectation Maximization algorithm to fit the model with observed data and constraints. Three real-world data sets are used for evaluation of the proposed method, two from university campus and one from ISP network.},
  Timestamp                = {2014.10.23},
  Url                      = {http://www.sciencedirect.com/science/article/pii/S0022000014000208}
}

@InProceedings{Wang-2011-Using,
  Title                    = {{Using Entropy to Classify Traffic More Deeply}},
  Author                   = {Wang, Yipeng and Zhang, Zhibin and Guo, Li and Li, Shuhao},
  Booktitle                = {Networking, Architecture and Storage (NAS), 2011 6th IEEE International Conference on},
  Year                     = {2011},
  Month                    = Jul,
  Pages                    = {45-52},

  Abstract                 = {The network community always pays its attention to find better methods for traffic classification, which is crucial for Internet Service Providers (ISPs) to provide better QoS for users. Prior works on traffic classification mainly focus their attentions on dividing Internet traffic into different categories based on application layer protocols (such as HTTP, Bit Torrent etc.). Making traffic classification from another point of view, we divide Internet traffic into different content types. Our technology is an attempt to solve the classification problem of network traffic, which contains unknown and proprietary protocols (i.e., no publicly available protocol specification). In this paper, we design a classifier which can distinguish Internet traffic into different content types using machine learning techniques. Features of our classifier are entropy of consecutive bytes and frequencies of characters. Our method is capable of classifying real-world traces into different content types (including Text, Picture, Audio, Video, Compressed, Base 64-encoded image, Base 64-encoded text and Encrypted). The chief features of our classifier are small computing space (about 1K Bytes) and high classification accuracy (about 81\%).},
  Doi                      = {10.1109/NAS.2011.18},
  Keywords                 = {Internet;learning (artificial intelligence);protocols;quality of service;telecommunication traffic;64-encoded image;Audio;Bit Torrent;HTTP;ISP;Internet service providers;Internet traffic;Picture;QoS;Text;Video;machine learning techniques;network community;traffic classification;Accuracy;Cryptography;Entropy;Internet;Machine learning;Payloads;Protocols;entropy vector;file content;machine learning;traffic classification},
  Location                 = {Dalian, Liaoning, China},
  Owner                    = {velan},
  Review                   = {Paper proposes to use entropy for traffic classification into eight classes: text, picture, video, audio, encoded text, encoded image, compressed, encrypted. Authors use support vector machine algorithm and compute entropy on words of length 1-6 bytes. In addition, they use frequencies of 4-bit characters to distinguish between encrypted and compressed traffic. The evaluation part is weak, more general dataset should be used. Authors argue that it is important to skip the protocol headers (e.g. image headers) to achieve the best results.},
  Timestamp                = {2014.06.16}
}

@InProceedings{Wanrooij-2005-Data,
  Title                    = {{Data on Retention}},
  Author                   = {van Wanrooij, Ward and Pras, Aiko},
  Booktitle                = {Proceedings of the 16th IFIP/IEEE Ambient Networks International Conference on Distributed Systems: Operations and Management},
  Year                     = {2005},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {60--71},
  Publisher                = {Springer-Verlag},
  Series                   = {DSOM'05},

  Acmid                    = {2179051},
  Doi                      = {10.1007/11568285_6},
  ISBN                     = {978-3-540-29388-0},
  Location                 = {Barcelona, Spain},
  Numpages                 = {12},
  Owner                    = {velan},
  Timestamp                = {2018.03.02},
  Url                      = {http://dx.doi.org/10.1007/11568285_6}
}

@Article{Williams-2009-Roofline,
  Title                    = {{Roofline: An Insightful Visual Performance Model for Multicore Architectures}},
  Author                   = {Williams, Samuel and Waterman, Andrew and Patterson, David},
  Journal                  = {Commun. ACM},
  Year                     = {2009},

  Month                    = apr,
  Number                   = {4},
  Pages                    = {65--76},
  Volume                   = {52},

  Acmid                    = {1498785},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/1498765.1498785},
  ISSN                     = {0001-0782},
  Issue_date               = {April 2009},
  Numpages                 = {12},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.11.30},
  Url                      = {http://doi.acm.org/10.1145/1498765.1498785}
}

@TechReport{Woo-2012-Scalable,
  Title                    = {{Scalable TCP session monitoring with symmetric receive-side scaling}},
  Author                   = {Woo, Shinae and Park, KyoungSoo},
  Year                     = {2012},

  Owner                    = {velan},
  Timestamp                = {2018.02.19},
  Url                      = {https://an.kaist.ac.kr/~shinae/paper/2012-srss.pdf}
}

@Online{WordPressCodex-2014-Brute,
  Title                    = {{Brute Force Attacks}},
  Author                   = {{WordPress Codex}},
  Url                      = {http://codex.wordpress.org/Brute_Force_Attacks},
  Urldate                  = {2017-10-20},

  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Article{Wright-2006-Inferring,
  Title                    = {{On Inferring Application Protocol Behaviors in Encrypted Network Traffic}},
  Author                   = {Wright, Charles V. and Monrose, Fabian and Masson, Gerald M.},
  Journal                  = {J. Mach. Learn. Res.},
  Year                     = {2006},

  Month                    = dec,
  Pages                    = {2745--2769},
  Volume                   = {7},

  Abstract                 = {Several fundamental security mechanisms for restricting access to network resources rely on the ability of a reference monitor to inspect the contents of traffic as it traverses the network. However, with the increasing popularity of cryptographic protocols, the traditional means of inspecting packet contents to enforce security policies is no longer a viable approach as message contents are concealed by encryption. In this paper, we investigate the extent to which common application protocols can be identified using only the features that remain intact after encryption---namely packet size, timing, and direction. We first present what we believe to be the first exploratory look at protocol identification in encrypted tunnels which carry traffic from many TCP connections simultaneously, using only post-encryption observable features. We then explore the problem of protocol identification in individual encrypted TCP connections, using much less data than in other recent approaches. The results of our evaluation show that our classifiers achieve accuracy greater than 90\% for several protocols in aggregate traffic, and, for most protocols, greater than 80\% when making fine-grained classifications on single connections. Moreover, perhaps most surprisingly, we show that one can even estimate the number of live connections in certain classes of encrypted tunnels to within, on average, better than 20\%.},
  Acmid                    = {1248647},
  ISSN                     = {1532-4435},
  Issue_date               = {12/1/2006},
  Numpages                 = {25},
  Owner                    = {velan},
  Publisher                = {JMLR.org},
  Review                   = {Authors show what can be achieved with without payloads and TCP headers, using only packet sizes, timing and direction. This simulates multiple flows wrapped in a single encryption tunnel. Real traffic traces are used for the evaluation. The port numbers are used as a ground truth and the authors argue that mislabeled data only decrease the efficiency and therefore the real accuracy would be even higher than the one measured. k-Nearest Neighbour classifier is used for classification when all TCP connections in a set carry the same application protocol. When the TCP connections might carry different application protocols, hiden Markov models are used for classification. Authors also show that it is possible to determine number of flows in encrypted tunnel.},
  Timestamp                = {2014.09.29},
  Url                      = {http://dl.acm.org/citation.cfm?id=1248547.1248647}
}

@InProceedings{Xie-2013-ReSurf,
  Title                    = {{ReSurf: Reconstructing Web-Surfing Activity from Network Traffic}},
  Author                   = {Guowu Xie and Iliofotou, Marios and Karagiannis, Thomas and Faloutsos, Michalis and Jin, Yaohui},
  Booktitle                = {IFIP Networking Conference, 2013},
  Year                     = {2013},
  Month                    = may,

  Keywords                 = {Internet;computer network management;hypermedia;telecommunication traffic;transport protocols;HTTP traffic;ReSurf;Web activity analysis;Web traffic;Web-surfing activity reconstruction;Website transitions;advertising services;network protection;network traffic;networks management;rights protection;tracking services;user requests;Browsers;Educational institutions;Google;Head;IP networks;Image reconstruction;Web pages},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@InCollection{Xu-2014-Toward,
  Title                    = {{Toward Identifying and Understanding User-Agent Strings in HTTP Traffic}},
  Author                   = {Xu, Ye and Xiong, Gang and Zhao, Yong and Guo, Li},
  Booktitle                = {Web Technologies and Applications},
  Publisher                = {Springer International Publishing},
  Year                     = {2014},
  Editor                   = {Han, Weihong and Huang, Zi and Hu, Changjun and Zhang, Hongli and Guo, Li},
  Pages                    = {177-187},
  Series                   = {Lecture Notes in Computer Science},
  Volume                   = {8710},

  Doi                      = {10.1007/978-3-319-11119-3_17},
  ISBN                     = {978-3-319-11118-6},
  Language                 = {English},
  Owner                    = {velan},
  Timestamp                = {2017.10.20}
}

@Online{Younan-2013-25,
  Title                    = {{25 Years of Vulnerabilities: 1988-2012}},
  Author                   = {Younan, Yves},
  Url                      = {https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdf},
  Urldate                  = {2018-03-02},
  Year                     = {2013},

  Owner                    = {velan},
  Timestamp                = {2018.03.02}
}

@InProceedings{Yu-2013-FlowSense,
  Title                    = {{FlowSense: Monitoring Network Utilization with Zero Measurement Cost}},
  Author                   = {Yu, Curtis and Lumezanu, Cristian and Zhang, Yueping and Singh, Vishal and Jiang, Guofei and Madhyastha, Harsha V.},
  Booktitle                = {Proceedings of the 14th International Conference on Passive and Active Measurement},
  Year                     = {2013},

  Address                  = {Berlin, Heidelberg},
  Pages                    = {31--41},
  Publisher                = {Springer-Verlag},
  Series                   = {PAM'13},

  Acmid                    = {2482367},
  Doi                      = {10.1007/978-3-642-36516-4_4},
  ISBN                     = {978-3-642-36515-7},
  Location                 = {Hong Kong, China},
  Numpages                 = {11},
  Owner                    = {velan},
  Timestamp                = {2017.04.27},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-36516-4_4}
}

@InProceedings{Zadnik-2008-Network,
  Title                    = {{Network Probe for Flexible Flow Monitoring}},
  Author                   = {Zadnik, Martin and Korenek, Jan and Kobiersky, Petr and Lengal, Ondrej},
  Booktitle                = {2008 11th IEEE Workshop on Design and Diagnostics of Electronic Circuits and Systems},
  Year                     = {2008},
  Month                    = apr,
  Pages                    = {1-6},

  Doi                      = {10.1109/DDECS.2008.4538788},
  Keywords                 = {Internet;XML;field programmable gate arrays;hardware description languages;logic design;telecommunication links;telecommunication traffic;FPGA chips;Internet traffic;VHDL;XML;field-programmable gate arrays;flexible flow monitoring;high-speed links;low-speed links;network acceleration card;network probe;real-time deployment;Acceleration;Computer architecture;Computer networks;Computerized monitoring;Field programmable gate arrays;IP networks;Probes;Semiconductor device measurement;Software testing;Telecommunication traffic},
  Owner                    = {velan},
  Timestamp                = {2018.02.18}
}

@Article{Zander-2012-Investigating,
  Title                    = {{Investigating the IPv6 Teredo Tunnelling Capability and Performance of Internet Clients}},
  Author                   = {Zander, Sebastian and Andrew, Lachlan L.H. and Armitage, Grenville and Huston, Geoff and Michaelson, George},
  Journal                  = {SIGCOMM Comput. Commun. Rev.},
  Year                     = {2012},

  Month                    = sep,
  Number                   = {5},
  Pages                    = {13--20},
  Volume                   = {42},

  Acmid                    = {2378959},
  Address                  = {New York, NY, USA},
  Doi                      = {10.1145/2378956.2378959},
  ISSN                     = {0146-4833},
  Issue_date               = {October 2012},
  Keywords                 = {ipv6, teredo},
  Numpages                 = {8},
  Owner                    = {velan},
  Publisher                = {ACM},
  Timestamp                = {2017.10.25},
  Url                      = {http://doi.acm.org/10.1145/2378956.2378959}
}

@InProceedings{Zhang-2007-Traffic,
  Title                    = {{Traffic Trace Artifacts due to Monitoring Via Port Mirroring}},
  Author                   = {Zhang, Jian and Moore, Andrew},
  Booktitle                = {E2EMON},
  Year                     = {2007},
  Editor                   = {Saraç, Kamil and Friedman, Timur},
  Pages                    = {1-8},
  Publisher                = {IEEE Computer Society},

  Added-at                 = {2011-09-15T00:00:00.000+0200},
  Doi                      = {10.1109/E2EMON.2007.375317},
  ISBN                     = {1-4244-1289-7},
  Keywords                 = {dblp},
  Owner                    = {velan},
  Timestamp                = {2015-06-18T13:31:15.000+0200},
  Url                      = {http://dblp.uni-trier.de/db/conf/e2emon/e2emon2007.html#ZhangM07}
}

@Conference{Zhang-2009-State,
  Title                    = {{State of the Art in Traffic Classification: A Research Review}},
  Author                   = {Zhang, Min and John, Wolfgang and Claffy, Kimberly C. and Brownlee, Nevil},
  Booktitle                = {PAM '09: 10th International Conference on Passive and Active Measurement, Student Workshop},
  Year                     = {2009},

  Abstract                 = {The Internet, while emerging as the key component for all sorts of communication, is far from well-understood. The goal of traffic classification is to understand the type of traffic carried on the Internet, which continually evolves in scope and complexity. For security and privacy reasons, many applications have emerged that utilize obfuscation techniques such as random ports, encrypted data transmission, or proprietary communication protocols. Further, applications adapt rapidly in the face of attempts to detect certain types of traffic, creating a challenge for traffic classification schemes. Research papers on Internet traffic classification try to classify whatever traffic samples a researcher can find, with no systematic integration of results. With the exception of machine learning techniques for traffic classification, we know of no complete overview of traffic classification attempts. To fill this gap, we have created a structured taxonomy of traffic classification papers and their datasets. To illustrate its utility, we use the taxonomy to answer the recently most popular question about traffic (“How much is peer-to-peer file sharing?”). Our survey also reveals open issues and challenges in traffic classification.},
  Keywords                 = {Internet Measurement, Traffic Analysis, Traffic Classification},
  Location                 = {Seoul, Korea},
  Owner                    = {velan},
  Timestamp                = {2014.10.24}
}

@InCollection{Zhang-2013-Encrypted,
  Title                    = {{Encrypted Traffic Classification Based on an Improved Clustering Algorithm}},
  Author                   = {Zhang, Meng and Zhang, Hongli and Zhang, Bo and Lu, Gang},
  Booktitle                = {Trustworthy Computing and Services},
  Publisher                = {Springer Berlin Heidelberg},
  Year                     = {2013},
  Pages                    = {124-131},
  Series                   = {Communications in Computer and Information Science},
  Volume                   = {320},

  Abstract                 = {Classification analysis of network traffic based on port number or payload is becoming increasingly difficult from security to quality of service measurements, because of using dynamic port numbers, masquerading and various cryptographic techniques to avoid detection. Research tends to analyze flow statistical features with machine learning techniques. Clustering approaches do not require complex training procedure and large memory cost. However, the performance of clustering algorithm like k-Means still have own disadvantages. We propose a novel approach of considering harmonic mean as distance matric, and evaluate it in terms of three metrics on real-world encrypted traffic. The result shows the classification has better performance compared with the previously.},
  Doi                      = {10.1007/978-3-642-35795-4_16},
  ISBN                     = {978-3-642-35794-7},
  Keywords                 = {traffic classification; machine learning; k-means clustering},
  Language                 = {English},
  Owner                    = {velan},
  Review                   = {Authors use K-Means for clustering encrypted traffic based on 10 flow features. The improvement over standard K-Means is through use of harmonic mean to reduce the impact of random initial clustering centers. The paper shows results of measurement on questionable data sets and cannot be taken too seriously. One of the data sets contains following applications: Skype, QQ, MSN, SSL, SSH, the other only differentiates bethenn SSH and no-SSH traffic.},
  Timestamp                = {2014.08.25},
  Url                      = {http://dx.doi.org/10.1007/978-3-642-35795-4_16}
}

@comment{jabref-entrytype: Online: req[author;title;url;urldate] opt[month;year]}