Date: Fri, 24 Dec 2010 11:18:18 +1100 From: Sebastian Zander <szander@swin.edu.au> To: freebsd-ipfw@freebsd.org Subject: IPFW extension for traffic classification based on statistical properties Message-ID: <4D13E6CA.7080005@swin.edu.au>
next in thread | raw e-mail | index | archive | help
Hi all, We believe this may be of some interest to list members, and apologise in advance for any duplicates you may receive. We are pleased to announce DIFFUSE v0.1, our first release of a system enabling FreeBSD's IPFW firewall subsystem to classify IP traffic based on statistical traffic properties. With DIFFUSE v0.1, IPFW computes statistics (such as packet lengths or inter-packet time intervals) for observed flows, and uses ML (machine learning) techniques to assign flows into classes. In addition to traditional packet inspection rules, IPFW rules may now also be expressed in terms of traffic statistics or classes identified by ML classification. This can be helpful when direct packet inspection is problematic (perhaps for administrative reasons, or because port numbers do not reliably identify classes of applications). DIFFUSE also enables one instance of IPFW to send flow information and classes to other IPFW instances, which then can act on such traffic (e.g. prioritise, accept, deny, etc) according to its class. This allows for distributed architectures, where classification at one location in your network is used to control fire-walling or rate-shaping actions at other locations. DIFFUSE v0.1 contains an example classifier model for identifying real-time first person shooter game traffic. In the next release we will include a classifier model to detect Skype traffic. The project site (http://caia.swin.edu.au/urp/diffuse) contains a more comprehensive introduction, including application examples, links to related work and documentation describing the design of our software. DIFFUSE v0.1 is a set of patches for FreeBSD-CURRENT, and can be obtained directly from http://caia.swin.edu.au/urp/diffuse/downloads.html The software was developed as part of the DIFFUSE research project at Swinburne University's Centre for Advanced Internet Architectures. The project has been made possible in part by a grant from the Cisco University Research Program Fund at Community Foundation Silicon Valley. We welcome your feedback and hope you enjoy playing with the code and tools. Cheers, Sebastian Zander and Grenville Armitage http://caia.swin.edu.au
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4D13E6CA.7080005>