Additionally, we present the notion of host profiling as a method for expanding traffic classification in cases where there is not a direct match between rendezvous traffic and application traffic. Specifically, through careful tracking of client IP addresses, alpha-numeric domain names, and answer IP addresses in rendezvous traffic, we apply classification labels to end-hosts and their traffic reported by flow-export data. Our approach exploits the most widely used rendezvous service, the Domain Name System (DNS).

In this paper, we present a novel method for classification based on analyzing rendezvous traffic (i.e., the traffic preamble in which a given host determines the remote IP address of a peer host or service) that usually precedes application traffic. The goal of our work is to develop a method for traffic classification that is flexible, i.e., that can be used to create arbitrary organizations of traffic from coarse to fine-grained groups, and can identify encrypted traffic as well as new applications.

In recent years, classification has become more challenging due to applications that use ports that are not well-known, that overload or masquerade with other applications' well-known ports, and that may encrypt or otherwise obfuscate their payload. The ability to accurately classify network traffic and to perform timely detection of the presence of unwanted classes of traffic has important implications for network operations and security.

Www rendezvous skype com