NDLI: Digging into HTTPS: flow-based classification of webmail traffic

Please wait, while we are loading the content...

CloudCmp: comparing public cloud providers

Detecting and characterizing social spam campaigns

On economic heavy hitters: shapley value analysis of 95th-percentile pricing

Measurement of loss pairs in network paths

Measurement and analysis of real-world 802.11 mesh networks

Primitives for active internet topology mapping: toward high-frequency characterization

Comparing and improving current packet capturing solutions based on commodity hardware

Netalyzr: illuminating the edge network

Listen to me if you can: tracking user experience of mobile network on social media

An empirical study of orphan DNS servers in the internet

Revisiting the case for a minimalist approach for network flow monitoring

Understanding latent interactions in online social networks

Selecting representative IP addresses for internet topology studies

BasisDetect: a model-based network event detection framework

Comparing DNS resolvers in the wild

Detecting algorithmically generated malicious domain names

Challenges in measuring online advertising systems

Measuring path MTU discovery behaviour

Characterizing radio resource allocation for 3G networks

Resolving IP aliases with prespecified timestamps

High speed network traffic analysis with commodity multi-core systems

An experimental study of home gateway characteristics

The effect of packet loss on redundancy elimination in cellular wireless networks

Flowroute: inferring forwarding table updates using passive flow-level measurements

Exact temporal characterization of 10 Gbps optical wide-area network

Measuring the mixing time of social graphs

Speed testing without speed tests: estimating achievable download speed from passive measurements

Temporally oblivious anomaly detection on large networks using functional peers

Improving content delivery using provider-aided distance information

Internet background radiation revisited

Demystifying service discovery: implementing an internet-wide scanner

On the feasibility of effective opportunistic spectrum access

On the impact of layer-2 on node degree distribution

Network tomography on correlated links

Network traffic characteristics of data centers in the wild

Performance comparison of 3G and metro-scale WiFi for vehicular network access

Digging into HTTPS: flow-based classification of webmail traffic

TraceNET: an internet topology data collector

Estimating and sampling graphs with multidimensional random walks

YouTube traffic dynamics and its interplay with a tier-1 ISP: an ISP perspective

What happened in my network: mining network events from router syslogs

Eyeball ASes: from geography to connectivity

Scamper: a scalable and extensible packet prober for active measurement of the internet

A first look at traffic on smartphones

The impact of YouTube recommendation system on video views

On the characteristics and reasons of long-lived internet flows

Towards an AS-to-organization map

Digging into HTTPS: flow-based classification of webmail traffic

Content Provider	ACM Digital Library
Author	Mühlbauer, Wolfgang Schatzmann, Dominik Spyropoulos, Thrasyvoulos Dimitropoulos, Xenofontas
Abstract	Recently, webmail interfaces, e.g., Horde, Outlook Web Access, and webmail platforms such as GMail, Yahoo!, and Hotmail have seen a tremendous boost in popularity. Given the importance of e-mail for personal and business use alike, and its exposure to imminent threats, there exists the need for a comprehensive view of the Internet mail system, including webmail traffic. We, in this paper, propose a novel, passive approach to identify webmail traffic solely based on network-level data in order to obtain a comprehensive view of the mail system. Key to our approach is that we leverage correlations across protocols and time to introduce three novel features for HTTPS webmail classification. Our first feature is based on the finding that webmail servers tend to reside close to legacy mail servers, e.g. IMAP and POP, which can be easily identified. Our second feature leverages that the usage of webmail services results in distinct patterns on sessions' duration and on the diurnal/weekly traffic usage profile. In addition, our third feature exploits the observation that traffic flows to webmail platforms exhibit inherent periodicities due to the fact that AJAX-based clients periodically check for new messages. We use these three features to build a simple classifier and detect webmail traffic on real-world NetFlow traces from a medium-sized backbone network. We believe that the major contribution of this paper -- exploring a set of new features that could classify applications that run over HTTPS ports solely based on NetFlow data -- will stimulate more general advance in the field of traffic classification.
Starting Page	322
Ending Page	327
Page Count	6
File Format	PDF
ISBN	9781450304832
DOI	10.1145/1879141.1879184
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-11-01
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Webmail Flow-level data Https traffic Traffic classification
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in