TreeTop and Rendezvous-based Traffic Classification

This page is regarding the TreeTop software and our DNS rendezvous-based method of traffic classification, used in the work reported in these papers:

My PhD dissertation also covers the aforementioned content. The additional material there, especially Chapters 1 and 2 (Introduction, Background and Related Work), may be useful in providing an overview of our method(s):

There isn't a proper distribution of TreeTop because it is implemented based on dnstop c. 2008 and is neither prepared nor documented for distribution; the method is licensed intellectual property for commercial use. Feel free to contact me if you happen to want more information about that, U.S. Patent No. 7,907,543, linked below.

Otherwise, if you're interested in related software for non-commercial use, I suggest you check out Pawel Foremski's freely-available "dnsclass":

The distribution of Tstat now includes DN-Hunter (from the IMC 2012 paper linked below):

Also, check out these papers which employ reimplementations of TreeTop and our method, AFAIK:

Hope this helps!


Intellectual Property Claims

These are related intellectual property/patent claims.
Please let me know of any additions, implementations, or other uses!


Dave Plonka, Jul 23 2019