The threat of malicious content on a network requires network administrators and users to accurately detect desirable traffic flow into their respective networks. To this effect, several studies have found it imperative to classify traffic flow, and to use traffic classification in various applications such as intrusion detection, monitoring systems, as well as pattern detection in various networks. Research into machine learning techniques of clustering emerged due to the inefficiencies and drawbacks of the traditional port-based and payload-based schemes. The classic Kmeans technique of clustering, in combination with other methods and parameters, can be used to build newer unsupervised and semi-supervised approaches to meliorate the quality of service in networks. In this paper, we review twelve of the existing clustering techniques. The review covers their contribution to clustering methods, the existing challenges, as well as recommendations for further research in clustering traffic flows.

No abstract

The task of network administrators to identify and determine the type of traffic traversing through the network is very critical to the rapid growth of new traffic each day. As the requirements of networks change over time, the situation of the network not able to meet some requirements is likely to occur. In a wide area network with a limited resource such as the low speed of links, frequent fragmentation of packets leading to extreme packet loss and costs is prominent resulting in the poor quality of service. As a result quantified amount of traffic flows can be classified at a time with limited features lowering the effectiveness of traffic classification. To improve upon the classification in such scenarios, we propose a hybrid semi-supervised clustering that is able to classify packet flows with restricted features and a small amount of packets while maintaining high accuracy in classification. We implement the above scenario in simulation and classify the limited flows obtained with our proposed algorithm. Evaluation results show that our proposed algorithm implemented into a classifier has good accuracy and precision values, with low processing time and error rates. The proposed strategy will enable network administrators during times of network resource depletion or upgrades provide and ensure the best quality of services and identify unwanted or malicious traffic.