Method and apparatus for classifying traffic at transport layer

Abstract

Provided is a method and apparatus for classifying applications in traffic easily and accurately by utilizing only statistical data of traffic at transport layer. A method of the present invention includes determining candidate applications by comparing at least one of smallest packet size, biggest packet size and average packet size of collected packets for a flow with corresponding reference data of potential applications; and comparing mode set of packet size for the collected packets with corresponding reference data of the candidate applications to identify the flow as an application which has identical elements in the same order, the number of the identical elements being equal to or more than a predetermined number.