Internet can be seen as an ever-changing platform where new types of services and applications are constantly
emerging. Consequently, novel communications paradigms are continuously appearing, generating traffic with different network
requirements. Besides, the emergence of highly stealth attacks leads to an increasing need of accurately profiling Internet
services, by mapping their traffic to the originating application, in order to improve network management tasks such as
resources optimization, network performance, service personalization and security. However, building such profiles is a
highly complex task due to the inherent complexity of network protocols and to the multiple restrictions that prevent or limit
the analysis of the generated traffic. Therefore, novel traffic identification methodologies are needed to provide accurate traffic
classification and user profiling. In this work, we review some the most relevant traffic classification methodologies that
have been published so far, including some recent patents. Then, the paper proposes new classification methodologies that, by
analyzing the dynamics of captured Internet traffic, can accurately discriminate the different frequency components generated
by diverse licit and illicit Internet applications. In this way, different signatures can be built for each application class, enabling
its accurate classification whether if belongs to licit applications or to stealth Internet threats.
Traffic Classification, Traffic Profiling, Multi-Scale Decomposition, Internet Attacks.
DETI, University of Aveiro/ Instituto de Telecomunicacoes, Campus de Santiago 3810-193 Aveiro, Portugal.