A Hybrid Classifier with a Binning Method for Network Application Identification

Abstract

Despite the increasing interest in application identification, the traditional approach based on transport layer port numbers has become less effective due to several reasons including the increasing use of random or non-standard port numbers and tunneling (e.g., HTTP tunnels). One approach to overcome this is to inspect application payload information. While highly accurate, it is limited and complicated for encrypted or obfuscated packets. Another common approach is to utilize flow statistics, such as flow size and duration, for classifying applications. Since it does not require to read packet contents, this approach has no limitation to plain-text flows, but it is known to be relatively less accurate.In this work, we develop a framework that incorporates those multiple classification techniques to offer accurate identification of applications with greater flexibility. In particular, we present our design of the hybrid classifier that performs classification based on machine learning with payload information and statistical flow-level features. With a recently collected traffic data set with a diverse set of applications, our experimental results show that our hybrid approach provides a high degree of accuracy for application identification yielding an accuracy of 95% on average. In addition, we propose an optimization technique with a novel binning method that partitions the given application set into multiple subgroups to improve the overall identification accuracy. Suh has over 20 years of higher education teaching and research experience in computer programming, data mining, database systems, computer operating systems, automata and formal language theory, network programming, artificial intelligence, data warehousing, systems design and analysis, and expert systems. He currently serves as President of the Society for Design and Process Science which is a professional organization with focus on transdisciplinary research.Wang-Hwan Lee received B.E. degree in Electronic Engineering from Kyungpook National University. From 1983 to 1999, he was a researcher working for ETRI, Korea, and participated in various projects in the areas of telecommunications and network technologies. He is currently an executive director in the Department of Project Planning and Adjustment at SYSMATE Inc. His main working area is concentrating on hadoop and mapreduce network traffic analytics. He currently serves the role of chief project leader of the IT R&D program of MOTIE/KEIT [10041548, "240Gbps real-time automatic signature generation system for application traffic classification supporting over 95% completeness and accuracy".