Flow Clustering Using Machine Learning Techniques

By A. McGregor, Mark A. Hall, Perry Lorier, James Brunskill. Passive and Active Network Measurement Conference, 2004

592 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Statistics and Probability

View Paper: https://www.semanticscholar.org/paper/cfc04be0eaf30ad81dcaaada8d6e6171aa058432

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Statistics and Probability

Citations in the corpus

Network Traffic Classification Using Correlation Information (2013, methodology): “[25] proposed to group traffic flows into a small number of clusters using the expectation maximization (EM) algorithm and manually label each cluster to an application.”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, methodology): “[303] employ EM to group flows with a certain probability and use cross-validation to find the optimal number of clusters.”
A Survey on Internet Traffic Identification (2009, methodology): “The most frequently discussed method is the Bayesian analysis technique as in [44][53], but some papers compare different methods [54][55][56].”
Bayesian Neural Networks for Internet Traffic Classification (2007, background): “[10] identify traffic with similar observable properties by applying an untrained classifier to the problem.”
Traffic classification through simple statistical fingerprinting (2007, background): “[10] show that traffic pattern similarity between different application layer protocols can be exploited to group observed flows into hierarchical clusters.”
Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques (2009, background): “Some proposals [4][5] need also semantically complete TCP flows as input.”
Characterization of Encrypted and VPN Traffic using Time-related Features (2016, background): “Flows are considered to be bidirectional (forward and reverse directions) as in most of the reviewed papers (e.g.,(McGregor et al., 2004; Zander et al., 2005; Bernaille et al., 2006; Williams et al., 2006; Palmieri and Fiore, 2009)).”
Internet traffic classification demystified: myths, caveats, and the best practices (2008, methodology): “Substantial attention has been invested in data mining techniques and machine learning algorithms using flow features for traffic classification [29, 31, 36, 9, 16, 17, 7, 14, 42, 20, 39, 27].”
Offline/realtime traffic classification using semi-supervised learning (2007, background): “As such, the focus of prior work [21, 32] and our own work [10] has been on demonstrating the ability of clustering algorithms to group together flows according to application type using only flow statistics and not on classifying new traffic.”
Function Words for Chinese Authorship Attribution (2012, methodology): “This time the cluster number is set to -1, which allows EM to use cross validation to automatically determine the optimal number of clusters (Smyth, 1996; McGregor et al., 2004).”
Internet traffic classification using bayesian analysis techniques (2005, background): “[11] seek to identify traffic with similar observable properties and apply an untrained classifier to this problem.”
A survey of techniques for internet traffic classification using machine learning (2008, methodology): “2) Directional neutrality: The assumption that application flows are bi-directional, and the application’s direction may be inferred prior to classification, permeates many of the works published to date ( [14] [48] [53] [46] [68]).”
Traffic classification using clustering algorithms (2006, methodology): “Both [10] and [17] only test Bayesian clustering techniques implemented by an EM algorithm.”
Support Vector Machines for TCP traffic classification (2009, background): “Campos et al. [3] and McGregor et al. [4] show that traffic pattern similarity can be exploited to group observed flows into hierarchical clusters: they prove that different application layer protocols shape the generated traffic in such a way that the corresponding flows belong to the same cluster.”
Automated traffic classification and application identification using machine learning (2005, methodology): “The Expectation Maximization (EM) algorithm is used in [13] to cluster flows into different application types using a fixed set of attributes.”
Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges (2017, methodology): “[67] propose an efficient packet tracing approach using the Expectation-Maximization (EM) probabilistic clustering algorithm, which groups flows (packets) into a small number of clusters, where the goal is to analyze network traffic using a set of representative clusters.”
BLINC: multilevel traffic classification in the dark (2005, methodology): “To address the ineﬃciency of port-based classiﬁcation, recent studies have employed statistical classiﬁcation techniques to probabilistically assign ﬂows to classes, e.g., machine learning [12] or statistical clustering [18, 15].”