RequIn, a tool for fast web traffic inference

Abstract — As networked attacks grow in complexity and more and more Internet users get broadband Internet access, application level traffic analysis in operator networks becomes more difficult. In this paper, we describe a tool allowing web communications to be analyzed in such environment. Instead of relying on the extraction of application level parameters and pattern matching algorithms that are usually considered bottlenecks for such activity, we look at simple network and transport level parameters to infer what happens at the application level. Our approach provides the ability to perform a trade-off between analysis speed and precision that in our opinion could be useful for some traffic analysis applications like denial of service attacks detection. Keywords-component; Monitoring, HTTP, performance, DDoS. I