A survey of techniques for internet traffic classification using machine learning

By Thuy T. T. Nguyen, Grenville J. Armitage. 2008

1,751 citations recorded by the source corpus.

The research community has begun looking for IP traffic classification techniques that do not rely on `well known¿ TCP or UDP port numbers, or interpreting the contents of packet payloads. New work is emerging on the use of statistical traffic characteristics to assist in the identification and classification process. This survey paper looks at emerging research into the application of Machine Learning (ML) techniques to IP traffic classification - an inter-disciplinary blend of IP networking and data mining techniques. We provide context and motivation for the application of ML techniques to IP traffic classification, and review 18 significant works that cover the dominant period from 2004 to early 2007. These works are categorized and reviewed according to their choice of ML strategies and primary contributions to the literature. We also discuss a number of key requirements for the employment of ML-based traffic classifiers in operational IP networks, and qualitatively critique the extent to which the reviewed works meet these requirements. Open issues and challenges in the field are also discussed.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers (2013, methodology): “, [27, 54, 49, 23, 25]) and machine learning algorithms pervade several contexts of information technology.”
A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges (2019, background): “Nguyen and Armitage [7] focus on IP traffic classification by using machine learning.”
UbeHealth: A Personalized Ubiquitous Cloud and Edge-Enabled Networked Healthcare System for Smart Cities (2018, background): “DEEP LEARNING NETWORK TRAFFIC CLASSIFICATION (DLNTC) COMPONENT Traffic classification is fundamental for any network, especially mobile cloud networks for determining anomalies, for traffic prioritization over a limited bandwidth, to ensure Quality of Service (QoS) [128], [129].”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, background): “For instance, Nguyen and Armitage [339], though impactful, is now dated and only addresses traffic classification in networking.”
Characterization of Tor Traffic using Time based Features (2017, background): “The industry as well as the research community have dedicated many efforts to the study of these technologies, developing several classification techniques (Nguyen and Armitage, 2008; Callado et al., 2009).”
A Survey of Multi-Access Edge Computing in 5G and Beyond: Fundamentals, Technology Integration, and State-of-the-Art (2019, neutral): “Recently, some surveys and tutorials on machine learning [339], deep learning [340], (deep) reinforcement learning [341]–[343], as well as their applications in communications and networking [344]–[346] have come out, and readers can refer to the aforementioned”
Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset (2018, positive): “• Network Flow Analysis and Deep Packet Inspection - can be categorized in two broad groups: (i) Deep Packet Inspection and (ii) Network Flow Analysis [20, 21, 4].”
A Survey of Payload-Based Traffic Classification Approaches (2014, methodology): “Thus, statistical classification methods circumvent these issues by using payload-independent parameters such as packet length, inter-arrival time and flow duration [1].”
An Overview on Application of Machine Learning Techniques in Optical Networks (2018, background): “Some applications of ML in different networking areas have already matched these expectations in areas such as intrusion detection [2], traffic classification [3], cognitive radios [4].”
AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic (2016, background): “Nguyen and Armitage [3] survey machine learning techniques for Internet trafﬁc clas-siﬁcation.”
A Survey of Random Forest Based Methods for Intrusion Detection Systems (2018, background): “In a well-organized survey, Nguyen and Armitage (2008) present a consistent review of main concepts, metrics, techniques, and input data used on network traffic classification.”
Towards the Deployment of Machine Learning Solutions in Network Traffic Classification: A Systematic Survey (2019, neutral): “The work in [2] presents a review of the traffic classification advances using ML in its early years.”
Issues and future directions in traffic classification (2012, methodology): “Finally, approaches based on host communication patterns use heuristics that can effectively complement payload inspection techniques, especially for obfuscated traffic.”
Network Traffic Classifier With Convolutional and Recurrent Neural Networks for Internet of Things (2017, methodology): “There are several approaches to NTC: port-based, payload-based, and ﬂow statistics-based [3], [4].”
SubFlow: Towards practical flow-level traffic classification (2012, background): “However, despite significant research efforts [14], [1], [12], these methods have not made the anticipated impact in the real world.”
A Very Brief Introduction to Machine Learning With Applications to Communication Systems (2018, neutral): “, Voice over IP [56].”
Network Anomaly Detection: Methods, Systems and Tools (2014, background): “developed in machine learning and statistics has been provided by [8], [9].”