A Real-Time Network Traffic Classifier for Online Applications Using Machine Learning

Abstract

The increasing ubiquity of network traffic and the new online applications’ deployment has increased traffic analysis complexity. Traditionally, network administrators rely on recognizing well-known static ports for classifying the traffic flowing their networks. However, modern network traffic uses dynamic ports and is transported over secure application-layer protocols (e.g., HTTPS, SSL, and SSH). This makes it a challenging task for network administrators to identify online applications using traditional port-based approaches. One way for classifying the modern network traffic is to use machine learning (ML) to distinguish between the different traffic attributes such as packet count and size, packet inter-arrival time, packet send–receive ratio, etc. This paper presents the design and implementation of NetScrapper, a flow-based network traffic classifier for online applications. NetScrapper uses three ML models, namely K-Nearest Neighbors (KNN), Random Forest (RF), and Artificial Neural Network (ANN), for classifying the most popular 53 online applications, including Amazon, Youtube, Google, Twitter, and many others. We collected a network traffic dataset containing 3,577,296 packet flows with different 87 features for training, validating, and testing the ML models. A web-based user-friendly interface is developed to enable users to either upload a snapshot of their network traffic to NetScrapper or sniff the network traffic directly from the network interface card in real time. Additionally, we created a middleware pipeline for interfacing the three models with the Flask GUI. Finally, we evaluated NetScrapper using various performance metrics such as classification accuracy and prediction time. Most notably, we found that our ANN model achieves an overall classification accuracy of 99.86% in recognizing the online applications in our dataset.

A Novel Method for Improved Network Traffic Prediction Using Enhanced Deep Reinforcement Learning Algorithm

“…Further, other studies claimed equivalent accuracy or more or less for traffic prediction, based on the types of network traffic. The application-oriented network traffic achieved comparatively less accuracy than the EDRL for network traffic of Amazon using the ANN algorithm (95.00%) [20,21], compared to 80.00% for EDONKEY traffic and 78.00% for FTP_CONTROL. For the network traffic of FTP and P2P, accuracy and precision were achieved at 94% and 90%, respectively, for the KNN algorithm [13,22].…”

“…Initially the dataset contained 54,000. The dataset was collected from ISCXVPN2016 [20] for VPNs and non-VPNs. The size of the dataset is almost 15 GB of ARFF file format, with a set of attributes with instance sharing.…”

“…The previous studies were measuring prediction accuracy using the KNN and RF [13,[20][21][22], and the accuracy was achieved at 72.08% and 90.53%, respectively, with EDONKEY application network traffic. The artificial neural network [23] was used to measure the network traffic, with performance measures regarding the capacity of the network and traffic loss.…”

A Scalable and Energy-Efficient LoRaWAN-Based Geofencing System for Remote Monitoring of Vulnerable Communities

“…LoRa's architecture is designed to enable long-range communication with minimal power consumption, making it ideal for applications in smart cities, agriculture, and environmental monitoring [15]. The critical characteristics of LoRa include its ability to operate over long distances, robustness to interference, and low data rate transmission, which are essential for battery-operated IoT devices [16]. However, the low data rate aspect of LoRa presents unique challenges in network protocol optimization, necessitating adaptations to the standard MANET protocols, such as the ECHO protocol, to operate efficiently in IoT [3].…”

Architecting a machine learning pipeline for online traffic classification in software defined networking using spark

“…Deep packet inspection (DPI) is developed to overcome the insufficiency of the port-based approach. It is based on inspecting the contents of the packet rather than its header [3]. Although this approach is considered reliable, it has some weaknesses.…”