{'fraction_non_alphanumeric': 0.026748971193415638, 'fraction_numerical': 0.0, 'mean_word_length': 4.969325153374233, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Improvement of application-level analysis of HTTP traffic through server-client correlation

In recent, the diversity and scale of network traffic has been expanding by the increase in various services and applications. Studies of application-level traffic analysis have been performed as the first step of the management and control of network traffic. Many studies have been utilizing “User-Agent” field in the HTTP header in order to analyze application-level HTTP traffic. As a result, most of HTTP-based applications can be classified with user-agent information, but some of HTTP traffic cannot be analyzed since it does not include user-agent field. In this paper, we use server-client correlation of HTTP service in order to improve completeness of HTTP analysis. Therefore, even though user-agent field does not exist in the HTTP header, analysis of application-level can be accomplished. We show our method feasibility through the experiment in a campus network.