Search

Deep packet inspection (DPI) has been extensively investigated in software-defined networking (SDN) as complicated attacks may intractably inject malicious payloads in the packets. Existing proprietary pattern-based or port-based third-party DPI tools can suffer from limitations in efficiently processing a large volume of data traffic. In this paper, a novel OpenFlow-enabled deep packet inspection (OFDPI) approach is proposed based on the SDN paradigm to provide adaptive and efficient packet inspection. First, OFDPI prescribes an early detection at the flow-level granularity by checking the IP addresses of each new flow via OpenFlow protocols. Then, OFDPI allows for deep packet inspection at the packet-level granularity: (i) for unencrypted packets, OFDPI extracts the features of accessible payloads, including tri-gram frequency based on Term Frequency and Inverted Document Frequency (TF–IDF) and linguistic features. These features are concatenated into a sparse matrix representation and are then applied to train a binary classifier with logistic regression rather than matching with specific pattern combinations. In order to balance the detection accuracy and performance bottleneck of the SDN controller, OFDPI introduces an adaptive packet sampling window based on the linear prediction; and (ii) for encrypted packets, OFDPI extracts notable features of packets and then trains a binary classifier with a decision tree, instead of decrypting the encrypted traffic to weaken user privacy. A prototype of OFDPI is implemented on the Ryu SDN controller and the Mininet platform. The performance and the overhead of the proposed solution are assessed using the real-world datasets through experiments. The numerical results indicate that OFDPI can provide a significant improvement in detection accuracy with acceptable overheads.

Having a clear insight on the protocols carrying traffic is crucial for network applications. Deep Packet Inspection (DPI) has been a key technique to provide visibility into traffic. DPI has proven effective in various scenarios, and indeed several open source DPI solutions are maintained by the community. Yet, these solutions provide different classifications, and it is hard to establish a common ground truth. Independent works approaching the question of the quality of DPI are already aged and rely on limited datasets. Here, we test if open source DPI solutions can provide useful information in practical scenarios, e.g., supporting security applications. We provide an evaluation of the performance of four open-source DPI solutions, namely nDPI, Libprotoident, Tstat and Zeek. We use datasets covering various traffic scenarios, including operational networks, IoT scenarios and malware. As no ground truth is available, we study the consistency of classification across the solutions, investigating rootcauses of conflicts. Important for on-line security applications, we check whether DPI solutions provide reliable classification with a limited number of packets per flow. All in all, we confirm that DPI solutions still perform satisfactorily for well-known protocols. They however struggle with some P2P traffic and security scenarios (e.g., with malware traffic). All tested solutions reach a final classification after observing few packets with payload, showing adequacy for on-line applications.

Recently proposed proposals, such as BlindBox (SIGCOMM 2015), PrivDPI (CCS 2019) and Pine (ESORICS 2020), enable privacy-preserving deep packet inspection (DPI) on the encrypted traffic. Despite that they protect traffic privacy and/or rule privacy against enterprises and the third-party middleboxes, they might not be really satisfactory, due to the leakage of the matching pattern. The matching pattern refers to the matched token-rule pairs during the process of inspection, which can be learnt by the middleboxes, leading to the privacy leakage concerns. Our work aims to hide the matching pattern, thereby enhancing the privacy on top of the mentioned proposals. Specifically, we propose a general framework for matching pattern hiding in DPI and construct a concrete scheme by resorting to the DDH-based private set intersection cardinality technique under the proposed framework. Besides, we implement the constructed scheme, and conduct extensive evaluations which demonstrate the practical performance of the scheme.

Nowadays, there is exponential growth in the field of wireless sensor networks. In WSN’s security is a major concern, since most of communication happen through a wireless media; hence, probability of attacks increases drastically. Intrusion detection as well as prevention measures should be taken for secure communication; hence, observations of intrusion detection and prevention techniques have taken immense precedence in the research field. With the help of intrusion detection and prevention systems, we can categorize the activities of user in two categories, namely normal activities and suspicious activities. There is a need to design effective intrusion detection and prevention system by exploring deep learning for wireless sensor networks. This research aims to deal with proposing algorithms and techniques for intrusion prevention system using deep packet inspection based on deep learning. In this, we have proposed a deep learning model using a convolutional neural network classifier. The proposed model consists of two stages like intrusion detection and intrusion prevention. The proposed model learns useful feature representations from a large amount of labeled data and then classifies them. In this work, a convolutional neural network is used to prevent intrusion for wireless sensor networks. To evaluate and test the effectiveness of the proposed system, a WSN-DS dataset is used, and experiments are conducted on the dataset. The experimental results show that proposed system achieves 97% accuracy and performs substantially better than the existing system. The proposed work can be used as a future benchmark for deep learning and intrusion prevention research communitiesin the smart cities nowadays.

We present an improved network attack evasion technique that allows malicious two-way communication and bypasses popular host and network intrusion techniques/systems that use deep packet inspection, signature analysis, and traffic behavior. The attack is based on previous research that leverages legitimate network traffic (existing or intuitively generated) from different contexts and reuses it to communicate malicious content. Still, contrary to previous research, the proposed approach: (i) provides increased bandwidth and allows us to exfiltrate large amounts of data with improved execution times while avoiding detection, and (ii) removes the administration privilege constraint that existed in previous implementations. Both novelties now make the attack feasible in real-world scenarios. We present two different attack implementations in different contexts, i.e., scripts/commands two-way communication and large data transfer. We test and validate our two implemented attacks using four popular NIDS, eight of the most popular endpoint protection solutions, and a Data Leakage Prevention System (DLP). Finally, we include a comparison of findings between our implementations of attacks and previous studies.

DNS rebinding attacks circumvent the same-origin policy of browsers and severely jeopardize user privacy. Although recent studies have shown that DNS rebinding attacks pose severe security threats to users, up to now little effort has been spent to assess the effectiveness of known solutions to prevent such attacks. We have carried out such a study to assess the protective measures proposed in prior studies. We found that none of the recommended techniques can entirely halt this attack due to various factors, e.g., network layer encryption renders packet inspection infeasible. Examining the previous problematic factors, we realize that a protective measure must be implemented at the browser-level. Therefore, we propose a defensive measure, a browser plug-in called Fail-rebind, that can detect, inform, and protect users in the event of an attack. Afterwards, we discuss the merits and limitations of our method compared to prior methods. Our findings suggest that Fail-rebind does not nec essitate expert knowledge, works on different OSes and smart devices, and is independent of networks and location.

Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users’ ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor’s traffic flow.

As a basic work of network security, network traffic recognition plays an important role in network resource management and abnormal network traffic monitoring. At present, network traffic identification has become one of the hottest issues in academic research. In the past research, network traffic analysis was mainly done by Port Matching, Deep Packet Inspection. However, these methods are not perfect, and they are not suitable for today. This paper implements a traffic recognition method based on deep learning and machine learning. Besides, this paper implements unsupervised clustering of traffic. On the UNB ISCX data set, the experimental results are quite good.

The paper concentrates on the issues related to the detection of anomalies in computer networks that are used in Small and Medium Enterprises (SME). The authors proposed the architecture of such a system based on the use of the initial traffic classifier and an arbiter supervising the work of the network. In this solution, after the learning stage using samples of real traffic (normal and abnormal) system detects abnormal traffic and uses Policy Based Routing (PBR) to redirect abnormal traffic for further analysis using Deep Packet Inspection (DPI) systems. This approach allows to significantly reduce the amount of traffic analyzed by IDS, and hence reduces the cost of purchasing and implementing security systems. The proposed model has been developed using the methodology OSEMN to work with data. The system can be used as the first step in the detection of threats and anomalies in systems with cascade security architecture.

Technology has revolutionized into connecting “things” together with the rebirth of the global network called Internet of Things (IoT). This is achieved through Wireless Sensor Network (WSN) which introduces new security challenges for Information Technology (IT) scientists and researchers. This paper addresses the security issues in WSN by establishing potential automated solutions for identifying associated risks. It also evaluates the effectiveness of various machine learning algorithms on two types of datasets, mainly, KDD99 and WSN datasets. The aim is to analyze and protect WSN networks in combination with Firewalls, Deep Packet Inspection (DPI), and Intrusion Prevention Systems (IPS) all specialized for the overall protection of WSN networks. Multiple testing options were investigated such as cross validation and percentage split. Based on the finding, the most accurate algorithm and the least time processing were suggested for both datasets.

This work presents the BRAINE Project approaches and solutions to enable AI-empowered industrial applications to efficiently and securely operate at the network edge. First, two use cases are presented to highlight the motivations for secure edge computing in industrial plants, including low-latency applications and the need to locally handle production data in a secure way. Then, AI-based proactive and reactive approaches are discussed to provide comprehensive cyber security at the industrial edge. Finally, two specific hardware accelerated implementations for cyber security are presented. The first implementation focuses on data encryption at network interface cards, the second implementation provides deep packet inspection for reconnaissance detection in switching elements. Results that hardware accelerated solutions enable the effective deployment of security solutions guaranteeing wire-speed operations while freeing CPU resources for industrial applications.

Lack of processing capabilities, regular updates, or patch-up and constrained resources make the highly autonomous and interconnected system of the Internet of Things (IoT) into a convenient location for several security breaches. There is a tremendous increase in the rate of cyberattacks in recent years, which alarms the cyber security force to develop more enhanced solutions by adopting new technologies and resources as never seen before. Security services like intrusion detection, packet inspection, and firewall are provided as a service through cloud servers using virtualization and Software Defined Networks (SDN). In this paper, a group-based access control mechanism which centers on SDN embedded fog nodes is proposed to provide routing based access control for sensitive IoT applications. Further, a second level of verification is done by the device itself by adopting the existing Cyclic Redundancy Check (CRC) and Message Authentication Code (MAC) without any extra overhead.

The post-COVID epidemic world has increased dependence on online businesses for day-to-day life transactions over the Internet, especially using the smartphone or handheld devices. This increased dependence has led to new attack surfaces which need to be evaluated by security researchers. The large market share of Android attracts malware authors to launch more sophisticated malware (12000 per day). The need to detect them is becoming crucial. Therefore, in this paper, we propose PICAndro that can enhance the accuracy and the depth of malware detection and categorization using packet inspection of captured network traffic. The identified network interactions are represented as images, which are fed in the CNN engine. It shows improved performance with the accuracy of 99.12% and 98.91% for malware detection and malware class detection, respectively, with high precision.

As Internet traffic classification is a typical problem for ISPs or mobile carriers, there have been a lot of studies based on statistical packet header information, deep packet inspection, or machine learning. Due to recent advances in end-to-end encryption and dynamic port policies, machine or deep learning has been an essential key to improve the accuracy of packet classification. In addition, ISPs or mobile carriers should carefully deal with the privacy issue while collecting user packets for accounting or security. The recent development of distributed machine learning, called federated learning, collaboratively carries out machine learning jobs on the clients without uploading data to a central server. Although federated learning provides an on-device learning framework towards user privacy protection, its feasibility and performance of Internet traffic classification have not been fully examined. In this paper, we propose a federated-learning traffic classification protocol (FLIC), which can achieve an accuracy comparable to centralized deep learning for Internet application identification without privacy leakage. FLIC can classify new applications on-the-fly when a participant joins in learning with a new application, which has not been done in previous works. By implementing the prototype of FLIC clients and a server with TensorFlow, the clients gather packets, perform the on-device training job and exchange the training results with the FLIC server. In addition, we demonstrate that federated learning-based packet classification achieves an accuracy of 88% under non-independent and identically distributed (non-IID) traffic across clients. When a new application that can be classified dynamically as a client participates in learning was added, an accuracy of 92% was achieved.

Due to many network services using encryption protocols, it poses a massive challenge to accurately identify traffic and provide quality of service (QoS). Although deep packet inspection (DPI) technology can identify most traffic, there are still many disadvantages to identifying encrypted traffic. In this paper, we apply the IP (Internet Protocol) autonomous system information query with machine learning (ML) and deep packet detection technology for traffic identification. By combining these methods, it can quickly provide good QoS for different types of encrypted traffic. The experimental results show that different encrypted traffic can be effectively identified. The services with different QoS requirements can be effectively identified even if they use the same protocol.

The pervasive use of encrypted protocols and new communication paradigms based on mobile and home IoT devices has obsoleted traffic analysis techniques that relied on clear text analysis. This has required new monitoring metrics being able to characterise, identify, and classify traffic not just in terms of network protocols but also behaviour and intended use. This paper reports the lessons learnt while analysing traffic in both home networks and the Internet, and it describes how monitoring metrics used in experiments have been implemented in an open source toolkit for deep packet inspection and traffic analysis. The validation process confirmed that combining the proposed metrics with deep packet inspection, it is possible to effectively characterise and fingerprint encrypted traffic generated by home IoT and non-IoT devices.

QUIC is an emerging transport protocol that has the potential to replace TCP in the near future. As such, QUIC will become an important target for Deep Packet Inspection (DPI). Reliable DPI is essential, e.g., for corporate environments, to monitor traffic entering and leaving their networks. However, elusion strategies threaten the validity of DPI systems, as they allow attackers to carefully design traffic to fool and thus evade on-path DPI systems. While such elusion strategies for TCP are well documented, it is unclear if attackers will be able to elude QUIC-based DPI systems. In this paper, we systematically explore elusion methodologies for QUIC. To this end, we present DPIFuzz: a differential fuzzing framework which can automatically detect strategies to elude stateful DPI systems for QUIC. We use DPIFuzz to generate and mutate QUIC streams in order to compare (and find differences in) the server-side interpretations of five popular open-source QUIC implementations. We show that DPIFuzz successfully reveals DPI elusion strategies, such as using packets with duplicate packet numbers or exploiting the diverging handling of overlapping stream offsets by QUIC implementations. DPIFuzz additionally finds four security-critical vulnerabilities in these QUIC implementations.

Payload classification is a kind of powerful deep packet inspection model built on the raw payloads of network traffic, and hence can remove the need of any configuration assumptions for network management and intrusion detection. While in the emerging industrial Internet, a majority of local industry owners are not willing to share their private payloads that possibly contain sensitive information and thus cause the classification model not always well trained due to the lack of sufficient training samples. In this paper, we address this privacy concern and propose a federated learning model for industrial payload classification. In particular, we consider a cloud-edge architecture for the industrial Internet topology, and assemble federated learning process by cloud-edge collaboration: each data owner has his own edge server for learning a local classification model and the industrial cloud takes the responsibility for aggregating local models to a federated one. We adopt a gradient-based deep convolutional neural network model as our local classifier and use the method of weighted gradient averaging for model aggregation. By this way, the data owners can avoid to disclose their private payload for model training, but instead share their local model’s gradients to keep the federated model able to learn local samples indirectly. At the end, we have conducted a large set of experiments with real-world industrial Internet traffic datasets, and have successfully confirmed the effectiveness of the proposed federated model for payload classification with privacy-preserved.

Distributed Reflection Denial of Service (DRDoS) attack has become one of the most serious threats to Internet security. With the ongoing development of 5G, a massive number of insecure Internet of Things (IoT) devices are connected to the Internet, which brings great challenges to defend against DRDoS attacks. To overcome these challenges, we extend the User Plane Function (UPF) of 5G core network, and propose a new framework accordingly for source IP address validation, so as to suppress the source IP address spoofing behaviors of DRDoS attackers. Under this framework, the packet inspection rate (PIR), i.e., the inspection probability of each packet, is crucial to simplify the validation complexity. To unveil the optimal PIR, we establish a two-player game which models the IP address spoofing and detection behaviors. Analysis on the formulated game implies a lower bound of sufficient PIR, which may be used to set PIR in practice. Simulation results show that the proposed method can efficiently deter IP spoofing behaviors. Thereby the derived PIR could achieve low-cost and effective defense of DRDoS.

In order to circumvent Internet censorship, more and more malicious users utilize Virtual Private Network (VPN) software to penetrate firewall and access restricted resources. It's important to identify and classify VPN traffic for network management and security. In this paper, 6 different kinds of VPN traffic are analyzed. Characterizing VPN traffic by Sample Entropy Fingerprint and Payload Length Sequence (PLS) separately, we apply Machine Learning (ML) algorithms to construct VPN traffic classifiers basing on these features. Comparing with Deep Packet Inspection (DPI), Sample Entropy Fingerprint and PLS, our result shows that the classifier based on PLS can achieve accurate VPN traffic classification, including obfuscated VPN traffic.

Clusters of firewalls is an architecture that can enhance cyber security and protect from network attackers. Deep Packet Inspection (DPI) is a sophisticated method used in firewalls to stop malicious activity within a network. However, DPI creates a performance drawback in terms of further processing and associated latency. There are very few published realistic experiments on firewall clusters and to the best of our knowledge, this is the first time that a study with real network equipment under realistic network conditions has measured and evaluated firewall clusters against single firewalls using DPI. We measured the induced latency while varying data traffic conditions such as speed and packet payload sizes. Our results clearly identify and quantify the conditions and architectures where deterioration in performance is quite significant. Our measurements show that in some cases the use of firewall clusters or DPI can increase latency and/or reduce speed by more than 10%. This new contribution to knowledge can help engineers and researchers when designing a network.

Restricting data plane processing to packet headers precludes analysis of payloads to improve routing and security decisions. DeepMatch delivers line-rate regular expression matching on payloads using Network Processors (NPs). It further supports packet reordering to match patterns in flows that cross packet boundaries. Our evaluation shows that an implementation of DeepMatch, on a 40 Gbps Netronome NFP-6000 SmartNIC, achieves up to line rate for streams of unrelated packets and up to 20 Gbps when searches span multiple packets within a flow. In contrast with prior work, this throughput is data-independent and adds no burstiness. DeepMatch opens new opportunities for programmable data planes.

While end-to-end encryption brings security and privacy to the end-users, it makes legacy solutions such as Deep Packet Inspection ineffective. Despite the recent work in machine learning-based encrypted traffic classification, these new techniques would require, if they were to be deployed in real enterprise-scale networks, an enhanced flow sampling due to sheer volume of data being traversed. In this paper, we propose a holistic architecture that can cope with encryption and multi-Gbps line rate with sampling and sketching flow statistics, which allows network operators to both accurately estimate the flow size distribution and identify the nature of VPN-obfuscated traffic. With over 6000 video traffic traces, we show that it is possible to achieve 99% accuracy for service provider classification even with sampled possibly inaccurate data.

Network slicing already plays an important role as a critical enabler in the current 5G technology domain. 5G aims to disrupt and accelerate innovation in various vertical fields, among those is the vehicular industry. In the detailed scope of the 5G-DRIVE research project promoting cooperation between the EU and China, a set of trials is to be undertaken towards promoting 5G growth. In this paper, initially, we identify a variety of challenges arising from the 5G convergence to the automotive industry. Then we describe the specific innovative framework of the 5G-DRIVE research, together with a novel network slicing mechanism deployed at the edge. Then an analysis on the corresponding architectures is presented, and how they operate in a set of trials for new 5G services. The services described are a virtualized caching network function (vCache), and a deep packet inspection one (vDPI), which are deployed at the edge facilitating an edge 5G service. For each case, the services are deployed and evaluated in the 5G Drive platform using the Katana slicing framework. Additional analysis of the OSM slicing platform is presented. The results demonstrate the performance of a network slicing mechanism for 5G service deployments in an edge enabled platform.

As Deep Packet Inspection (DPI) middleboxes become increasingly popular, a spectrum of adversarial attacks have emerged with the goal of evading such middleboxes. Many of these attacks exploit discrepancies between the middlebox network protocol implementations, and the more rigorous/complete versions implemented at end hosts. These evasion attacks largely involve subtle manipulations of packets to cause different behaviours at DPI and end hosts, to cloak malicious network traffic that is otherwise detectable. With recent automated discovery, it has become prohibitively challenging to manually curate rules for detecting these manipulations. In this work, we propose CLAP, the first fully-automated, unsupervised ML solution to accurately detect and localize DPI evasion attacks. By learning what we call the packet context, which essentially captures inter-relationships across both (1) different packets in a connection; and (2) different header fields within each packet, from benign traffic traces only, CLAP can detect and pinpoint packets that violate the benign packet contexts (which are the ones that are specially crafted for evasion purposes). Our evaluations with 73 state-of-the-art DPI evasion attacks show that CLAP achieves an Area Under the Receiver Operating Characteristic Curve (AUC-ROC) of 0.963, an Equal Error Rate (EER) of only 0.061 in detection, and an accuracy of 94.6% in localization. These results suggest that CLAP can be a promising tool for thwarting DPI evasion attacks., 12 pages, 12 figures; accepted to ACM CoNEXT 2020

Visibility into network traffic is a key requirement for different security and network monitoring tools. Recent trends in the evolution of Internet traffic present a challenge for traditional traffic analysis methods to achieve accurate classification of Internet traffic including Voice over IP (VoIP), text messaging, video, and audio services among others. A key aspect of this trend is the rising levels of encrypted multiple service channels where the payload is opaque to middleboxes in the network. In such scenarios, traditional approaches such as Deep Packet Inspection (DPI) or examination of Port numbers are unable to achieve the classification accuracy required. This work investigates Machine Learning-based network traffic classifiers as a means of accurately classifying encrypted multiple service channels. The study carries out a thorough study which (i) proposes and evaluates two machine learning-based frameworks for multiple service channels analysis; (ii) undertakes feature engineering to identify the minimum number of features required to obtain high accuracy while reducing the effects of over-fitting; (iii) explores the portability and robustness of the frameworks trained models under different network conditions: location, time, and volume; and (iv) collects and analyzes a large-scale dataset including nine classes of services, for benchmarking purposes.

Traffic Characterization, Application Identification, Per Application Classification, and VPN/Non-VPN Traffic Characterization have been some of the most notable research topics over the past few years. Deep Packet Inspection (DPI) promises an increase in Quality of Service (QoS) for Internet Service Providers (ISPs), simplifies network management and plays a vital role in content censoring. DPI has been used to help ease the flow of network traffic. For instance, if there is a high priority message, DPI could be used to enable high-priority information to pass through immediately, ahead of other lower priority messages. It can be used to prioritize packets that are mission-critical, ahead of ordinary browsing packets. Throttling or slowing down the rate of data transfer can be achieved using DPI for certain traffic types like peer-to-peer downloads. It can also be used to enhance the capabilities of ISPs to prevent the exploitation of Internet of Things (IoT) devices in Distributed Denial-Of-Service (DDOS) attacks by blocking malicious requests from devices. In this paper, we introduce a novel architecture for DPI using neural networks utilizing layers of word embedding, convolutional neural networks and bidirectional recurrent neural networks which proved to have promising results in this task. The proposed architecture introduces a new mix of layers which outperforms the proposed approaches before.

This paper classifies the VPN network traffic flow using the time related features on the Apache Spark and artificial neural networks. Today's, internet traffic is encrypted using protocols like VPN/Non-VPN. This situation prevents the classic deep packet inspection approaches by analyzing packet payloads. For the implementation of this research, MATLAB 2019b would be forwarded in use as increasing demand for VPN networks has actuated the evolutionary technology. The proposed method will prevent unnecessary processing as well as flooding found in standard VPN network traffic classification. As the proposed system is trained on 80 of the dataset while 20% is kept for the testing and validation with 10-cross fold validation as well as 50 epochs of training. To the best of our knowledge, this is the first study that introduces and utilizes artificial neural networks and apache spark engine to implement the classification of VPN network traffic flow. The accuracy of the VPN classification using ANN and Apache Spark Engine is 96.76%. The accuracy of the Non-VPN classification using the proposed method is 92.56%. This study has shown that an approach using the CIC-Darknet2020 for packet-level encrypted traffic classification cannot incorporate packet header information, as it allows to directly map a packet to a specific application with high accuracy. Considering only non-VPN traffic, 96.76% of all packets in the dataset can be associated with an application. The remaining packets can still be classified with high probability by predicting based on the applications that use this flow.

A secure network layer capable of distinguishing between malicious and genuine traffic flows is the need of every transit service provider, edge network, corporate customer, and a common Internet user. With the emergence of advanced technologies, the demand for security has been drastically increased over the past decade. The analysis of network traffic is essential for various tasks like security, capacity planning, and visibility at various levels. In this paper, a novel architecture is proposed which exploits two powerful techniques for network traffic inspection, that is, cluster analysis and statistical modeling, and unifies them in a single framework. The proposed architecture leverages the clustering technique and statistical modeling for analyzing and inspecting the network traffic. Instead of selecting NetFlow records as the primary format, this research paper presents an approach that employs Packet Capture (PCAP) data format for network analysis. The clustering technique can be used for classifying benign and malicious traffic but there may arise many uncertainties caused by various dynamic factors due to emerging application mixture. Our proposed model uses statistical modeling for supplementing the results obtained from clustering. This unified approach for traffic analysis reduces the chances of the false alert generation that substantially deteriorates the security ecosystem. The proposed architecture inspects different parameters of network traffic to uncover any strong correlation for identifying malicious network traffic flows.