SimpleCompare

The following tables show how well SimpleCompare did against all four databases. The number of samples represents how many pcap files the input fingerprints were computed across. 1-sample means that the fingerprint was computed only from the first sample for a given implementation, while 3-sample means all three pcap files were used to generate the print.

Table 5.2 below shows how well SimpleCompare does when it is only analyzing durations, not (packet_type, duration) pairs. Table 5.3 shows how well SimpleCompare does when it only analyzed (packet_type, duration) pairs. Table 5.4 shows the results when both techniques are combined.

Table 5.2: SimpleCompare, duration values only

$\begin{table} \begin{center} \begin{tabular}{\vert l\vert l\vert l\vert l\ver... ... \textbf{0.9393}&&\\ \hline \par \end{tabular} \end{center} \end{table}% WIDTH=547 HEIGHT=99$

Table 5.3: SimpleCompare, (packet_type, duration) pairs only

$\begin{table} \begin{center} \begin{tabular}{\vert l\vert l\vert l\vert l\ver... ...&& \textbf{0.9706}&& \\ \hline \end{tabular} \end{center} \end{table}% WIDTH=547 HEIGHT=99$

Table 5.4: SimpleCompare combined.

$\begin{table} \begin{center} \begin{tabular}{\vert l\vert l\vert l\vert l\ver... ...&& \textbf{0.9701}&& \\ \hline \end{tabular} \end{center} \end{table}% WIDTH=547 HEIGHT=99$

Though combining the two techniques did not improve the overall average, it did have one important effect. In the combined table, scores consistently increase with sample size, across all databases. This is not the case in either of the two tables preceding it. This is a very desirable property, and could arguably be worth the minor price paid in overall accuracy.

Next: MediumCompare Up: Results Previous: Results Contents