Application traffic classification at the early stage by characterizing application rounds

Huang, Nen-Fu; Jai, Gin-Yuan; Chao, Han-Chieh; Tzang, Yih-Jou; Chang, Hong-Yi

doi:10.1016/j.ins.2012.12.039

Cited by 54 publications

(18 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…A traffic flow is defined as a bi-directional ordered sequence of packets, which consists of the same 5-tuple: source IP, destination IP, source port, destination port, and transport layer protocol. In this study, the features are extracted from the application layer and transport layer perspectives [5]. They consist of the number of the packets and the packet sizes of the first interaction round, the size of the first 5 packets of each TCP/UDP flow, the source port and the destination port of the connection.…”

Section: Feature Extractionmentioning

confidence: 99%

Applying Big Data, Machine Learning, and SDN/NFV for 5G Early-Stage Traffic Classification and Network QoS Control

Lin

2018

TNC

View full text Add to dashboard Cite

Due to the rapid growth of mobile broadband and IoT applications, the early-stage mobile traffic classification becomes more important for traffic engineering to guarantee Quality of Service (QoS), implement resource management, and network security. Therefore, identifying traffic flows based on a few packets during the early state has attracted attention in both academic and industrial fields. However, a powerful and flexible platform to handle millions of traffic flows is still challenging. This study aims to demonstrate how to integrate various state-of-the-art machine learning (ML) algorithms, big data analytics platforms, software-defined networking (SDN), and network functions virtualization (NFV) to build a comprehensive framework for developing future 5G SON applications. This platform successfully collected, stored, analyzed, and identified a huge number of real-time traffic flows at broadband Mobile Lab (BML), National Chiao Tung University (NCTU). Moreover, we also implemented network QoS control to configure priorities per-flow traffic to enable bandwidth guarantees for each application by using SDN. Finally, the performance of the proposed models was evaluated by applying them to a real testbed environment. The powerful computing capacity of the platform was also analyzed.

show abstract

Section: Feature Extractionmentioning

confidence: 99%

Applying Big Data, Machine Learning, and SDN/NFV for 5G Early-Stage Traffic Classification and Network QoS Control

Lin

2018

TNC

View full text Add to dashboard Cite

show abstract

“…Therefore, it is hard to classify P2P traffic in real-time with PeerRush. Huang et al [14] proposed a traffic classification method that employs the application round feature set and a pruned C4.5 tree machine learning algorithm to characterize application rounds and identify application traffic in real-time. The average overall accuracy of proposed method reaches 92.88%.…”

Section: Related Workmentioning

confidence: 99%

PeerSorter: Classifying Generic P2P Traffic in Real-Time

Yang

Wang

et al. 2014

2014 IEEE 17th International Conference on Computational Science and Engineering

View full text Add to dashboard Cite

The rapid development of Peer-to-Peer (P2P) technology brings challenges to quality of service (QoS), network planning and access control. An accurate classification of P2P traffic is vital for addressing those challenges. Traditional portbased and payload-based methods fail to cope with emerging port disguise and payload encryption techniques. In this paper, we present PeerSorter, a system for the classification of generic P2P traffic in real-time. PeerSorter is featured by four characteristics. Firstly, it can accurately classify nearly all kinds of legitimate P2P applications as well as various P2P botnets, by building application profiles of their significant network activity patterns. Moreover, PeerSorter is capable of real-time processing, because of its simplicity of mechanism and small classification time windows. In addition, PeerSorter can be readily extended by adding profiles of new P2P applications. Finally, PeerSorter can work well even in the scenario where the classification target is running along with other bandwidth consumer (including P2P applications) at the same time. We evaluate the performance of PeerSorter on traffic datasets of a large variety of P2P applications, including two popular P2P botnets. The experimental results demonstrate that we can classify all the considered types of P2P traffic with an average true positive rate of 97.83% and an average false positive rate below 0.04% within 2 minutes.

show abstract

“…Machine learning algorithm [3] based on statistical flow features is a promise alternative in Internet traffic classification since it is more robust to traffic obfuscation. Recently, researchers explore methods for robust traffic classification [4] or online traffic classification [5], but they mainly pursue high flow accuracy and ignore byte accuracy often. Flow accuracy is the number of correctly classified flows to the total number of flows, while byte accuracy is the number of correctly classified bytes to the total number of bytes on a dataset.…”

Section: Introductionmentioning

confidence: 99%

Large traffic flows classification method

Liu

Wang

et al. 2014

2014 IEEE International Conference on Communications Workshops (ICC)

View full text Add to dashboard Cite

To Ensure QoE (quality of experience) to the users when they access so many Internet applications every day, ISPs are faced with challenge and opportunity in bandwidth management. They need some ways to identify each application's flows generated by user hosts, especially the application classes with large flows because of the higher bandwidth occupation comparing with the other classes with small flows. A novel method is presented to modularize flow size using information gain ratio. The origin dataset is properly partitioned into large flow and small flow subsets by a threshold that is achieved when the data complexity of large flow subset is minimized. The searching algorithm of the partitioned threshold is independent of classification performance. The specific classifiers can be trained to identify large flows and small flows properly on each subset in generalization. Experimental results on real world traffic datasets show that byte accuracy increased 30% averagely when our method is compared with original.

show abstract

Application traffic classification at the early stage by characterizing application rounds

Cited by 54 publications

References 27 publications

Applying Big Data, Machine Learning, and SDN/NFV for 5G Early-Stage Traffic Classification and Network QoS Control

Applying Big Data, Machine Learning, and SDN/NFV for 5G Early-Stage Traffic Classification and Network QoS Control

PeerSorter: Classifying Generic P2P Traffic in Real-Time

Large traffic flows classification method

Contact Info

Product

Resources

About