Automated traffic classification and application identification using machine learning

By Sebastian Zander, Thuy T. T. Nguyen, Grenville J. Armitage. IEEE Conference on Local Computer Networks, 2005

583 citations recorded by the source corpus.

The dynamic classification and identification of network applications responsible for network traffic flows offers substantial benefits to a number of key areas in IP network engineering, management and surveillance. Currently such classifications rely on selected packet header fields (e.g. port numbers) or application layer protocol decoding. These methods have a number of shortfalls e.g. many applications can use unpredictable port numbers and protocol decoding requires a high amount of computing resources or is simply infeasible in case protocols are unknown or encrypted. We propose a novel method for traffic classification and application identification using an unsupervised machine learning technique. Flows are automatically classified based on statistical flow characteristics. We evaluate the efficiency of our approach using data from several traffic traces collected at different locations of the Internet. We use feature selection to find an optimal feature set and determine the influence of different features

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/3cc637cfd4ad49e48a251615bcc69a5bd754604b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Network Traffic Classification Using Correlation Information (2013, methodology): “[26] used AutoClass to group traffic flows and proposed a metric called intraclass homogeneity for cluster evaluation.”
A survey of techniques for internet traffic classification using machine learning (2008, methodology): “[46], proposed in 2005, uses AutoClass [50], which is an unsupervised Bayesian classifier,”
Offline/realtime traffic classification using semi-supervised learning (2007, background): “As such, the focus of prior work [21, 32] and our own work [10] has been on demonstrating the ability of clustering algorithms to group together flows according to application type using only flow statistics and not on classifying new traffic.”
Internet traffic classification demystified: myths, caveats, and the best practices (2008, methodology): “Previous efforts on flowfeatures-based classification [29, 31, 36, 9, 16, 7, 14, 42, 20, 39] have shown that bidirectional TCP flow statistics provide such fingerprints for various applications.”
Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques (2009, methodology): “A number of works [5][6][7] rely on unsupervised learning techniques.”
Traffic classification using clustering algorithms (2006, methodology): “Both [10] and [17] only test Bayesian clustering techniques implemented by an EM algorithm.”
A Survey on Internet Traffic Identification (2009, methodology): “The most frequently discussed method is the Bayesian analysis technique as in [44][53], but some papers compare different methods [54][55][56].”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, methodology): “Average packet size is fairly constant in nature [492] and packet inter-arrival times are a good discriminator for bulk data transfer (e.”
Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges (2017, methodology): “Another similar automated traffic classifier and application identifier can be seen in [175], and they use the auto-class unsupervised Bayesian classifier, which automatically learns the inherent natural classes in a dataset.”