{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T00:49:53Z","timestamp":1777682993561,"version":"3.51.4"},"reference-count":34,"publisher":"SAGE Publications","issue":"4","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JHS"],"published-print":{"date-parts":[[2024,10,15]]},"abstract":"<jats:p>Deep Packet Inspection (DPI) methods are extensively used in traffic classification. These methods extract unique application content either at byte or bit level granularity and represent them as signatures. DPI involves string or regular expression matching, which is computationally expensive, and evaluating signatures at bit-level granularity makes it even more inefficient. With the ever-increasing bandwidth and the high-speed internet traffic, the software implementations of DPI have become a performance bottleneck. In this paper, we propose HClass, a DPI-based network traffic classifier completely implemented in software to speed up signature matching. Our contributions with HClass are three-fold. First, we propose a hybrid signature matching technique with a combination of bit and byte-level signatures. Second, we propose methods to perform bit-level signature matching with byte\/word level operations to cope with software implementations and be compatible with general-purpose CPU operations. Third, it uses a two-phase signature matching where first-phase signatures are short and quickly identify the potential application(s), and the second-phase signatures verify the potential application(s) to reduce false positives. We perform experiments with HClass on three datasets and report classification performance and execution time improvement of HClass with our implementations in C language.<\/jats:p>","DOI":"10.3233\/jhs-230145","type":"journal-article","created":{"date-parts":[[2024,6,11]],"date-time":"2024-06-11T13:01:44Z","timestamp":1718110904000},"page":"517-533","source":"Crossref","is-referenced-by-count":2,"title":["HClass: Fast hybrid network traffic classification with bit and keyword level signatures"],"prefix":"10.1177","volume":"30","author":[{"given":"Pratibha","family":"Khandait","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, Indian Institute of Technology Indore, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Neminath","family":"Hubballi","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Indian Institute of Technology Indore, India"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","reference":[{"key":"10.3233\/JHS-230145_ref1","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.comnet.2019.106944","article-title":"MIMETIC: Mobile encrypted traffic classification using multimodal deep learning","volume":"165","author":"Aceto","year":"2019","journal-title":"Computer Networks"},{"key":"10.3233\/JHS-230145_ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.dcan.2022.09.009"},{"key":"10.3233\/JHS-230145_ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2013.6655003"},{"issue":"2","key":"10.3233\/JHS-230145_ref4","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1145\/1129582.1129589","article-title":"Traffic classification on the fly","volume":"36","author":"Bernaille","year":"2006","journal-title":"SIGCOMM Computer Communication Review"},{"issue":"10","key":"10.3233\/JHS-230145_ref5","doi-asserted-by":"publisher","first-page":"762","DOI":"10.1145\/359842.359859","article-title":"A fast string searching algorithm","volume":"20","author":"Boyer","year":"1977","journal-title":"Communications of the ACM"},{"key":"10.3233\/JHS-230145_ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNC.2012.6167418"},{"key":"10.3233\/JHS-230145_ref7","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2009.5425469"},{"key":"10.3233\/JHS-230145_ref8","doi-asserted-by":"publisher","DOI":"10.5555\/2930611.2930647"},{"key":"10.3233\/JHS-230145_ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102890"},{"key":"10.3233\/JHS-230145_ref11","doi-asserted-by":"publisher","first-page":"68","DOI":"10.1016\/j.comnet.2017.07.018","article-title":"Ensemble network traffic classification: Algorithm comparison and novel ensemble scheme proposal","volume":"127","author":"G\u00f3mez","year":"2017","journal-title":"Computer Networks"},{"key":"10.3233\/JHS-230145_ref12","doi-asserted-by":"publisher","first-page":"79","DOI":"10.1016\/j.comcom.2021.12.021","article-title":"KeyClass: Efficient keyword matching for network traffic classification","volume":"185","author":"Hubballi","year":"2022","journal-title":"Computer Communications"},{"key":"10.3233\/JHS-230145_ref13","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2017.8254001"},{"issue":"5","key":"10.3233\/JHS-230145_ref14","doi-asserted-by":"publisher","first-page":"2334","DOI":"10.1109\/TNET.2018.2868816","article-title":"BitCoding: Network traffic classification through encoded bit level signatures","volume":"26","author":"Hubballi","year":"2018","journal-title":"IEEE\/ACM Transaction on Networking"},{"issue":"3","key":"10.3233\/JHS-230145_ref15","doi-asserted-by":"publisher","first-page":"1730","DOI":"10.1109\/TNSM.2020.2999856","article-title":"BitProb: Probabilistic bit signatures for accurate application identification","volume":"17","author":"Hubballi","year":"2020","journal-title":"IEEE Transactions on Network and Service Management"},{"key":"10.3233\/JHS-230145_ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2133360.2133364"},{"issue":"1","key":"10.3233\/JHS-230145_ref17","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1109\/TMSCS.2017.2765324","article-title":"DPFEE: A high performance scalable pre-processor for network security systems","volume":"4","author":"Jyothi","year":"2018","journal-title":"IEEE Transactions on Multi-Scale Computing Systems"},{"key":"10.3233\/JHS-230145_ref18","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080119"},{"key":"10.3233\/JHS-230145_ref19","doi-asserted-by":"publisher","DOI":"10.1109\/COMSNETS48256.2020.9027353"},{"key":"10.3233\/JHS-230145_ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109017"},{"key":"10.3233\/JHS-230145_ref21","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737507"},{"issue":"4","key":"10.3233\/JHS-230145_ref23","doi-asserted-by":"publisher","first-page":"56","DOI":"10.1109\/SURV.2008.080406","article-title":"A survey of techniques for Internet traffic classification using machine learning","volume":"10","author":"Nguyen","year":"2008","journal-title":"IEEE Communications Surveys & Tutorials"},{"key":"10.3233\/JHS-230145_ref24","doi-asserted-by":"publisher","DOI":"10.5220\/0007384203970404"},{"key":"10.3233\/JHS-230145_ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2019.8761954"},{"key":"10.3233\/JHS-230145_ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028805"},{"key":"10.3233\/JHS-230145_ref27","doi-asserted-by":"publisher","first-page":"920","DOI":"10.1016\/j.compeleceng.2018.03.005","article-title":"Network traffic classification based on transfer learning","volume":"69","author":"Sun","year":"2018","journal-title":"Computers & Electrical Engineering"},{"issue":"4","key":"10.3233\/JHS-230145_ref28","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1049\/iet-net.2017.0065","article-title":"RDClass: On using relative distance of keywords for accurate network traffic classification","volume":"7","author":"Swarnkar","year":"2018","journal-title":"IET Networks"},{"issue":"1","key":"10.3233\/JHS-230145_ref30","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1016\/j.comcom.2014.03.026","article-title":"Towards self adaptive network traffic classification","volume":"56","author":"Tongaonkar","year":"2015","journal-title":"Computer Communication"},{"key":"10.3233\/JHS-230145_ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SCC.2016.133"},{"key":"10.3233\/JHS-230145_ref32","doi-asserted-by":"publisher","DOI":"10.5555\/3323234.3323286"},{"key":"10.3233\/JHS-230145_ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2012.6459963"},{"issue":"4","key":"10.3233\/JHS-230145_ref35","doi-asserted-by":"publisher","first-page":"704","DOI":"10.1109\/LCOMM.2016.2521837","article-title":"Bits learning: User-adjustable privacy versus accuracy in Internet traffic classification","volume":"20","author":"Yuan","year":"2016","journal-title":"IEEE Communications Letters"},{"key":"10.3233\/JHS-230145_ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2789997"},{"issue":"1","key":"10.3233\/JHS-230145_ref37","doi-asserted-by":"publisher","first-page":"583","DOI":"10.1109\/TNET.2014.2381230","article-title":"A semantics-aware approach to the automated network protocol identification","volume":"24","author":"Yun","year":"2016","journal-title":"IEEE\/ACM Transactions on Networking"},{"issue":"5","key":"10.3233\/JHS-230145_ref38","doi-asserted-by":"publisher","first-page":"573","DOI":"10.1016\/j.jcss.2012.11.004","article-title":"Unsupervised traffic classification using flow statistical properties and IP packet payload","volume":"79","author":"Zhang","year":"2013","journal-title":"Journal of Computer and System Sciences"}],"container-title":["Journal of High Speed Networks"],"original-title":[],"link":[{"URL":"https:\/\/content.iospress.com\/download?id=10.3233\/JHS-230145","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T08:44:40Z","timestamp":1777452280000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.medra.org\/servlet\/aliasResolver?alias=iospress&doi=10.3233\/JHS-230145"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,15]]},"references-count":34,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.3233\/jhs-230145","relation":{},"ISSN":["1875-8940","0926-6801"],"issn-type":[{"value":"1875-8940","type":"electronic"},{"value":"0926-6801","type":"print"}],"subject":[],"published":{"date-parts":[[2024,10,15]]}}}