Clustering-based separation of media transfers in DPI-classified cellular video and VoIP traffic

Abstract

Identifying VoIP and video traffic is often useful in the context of managing a cellular network, and to perform such traffic classification deep packet inspection (DPI) approaches are often used. Commercial DPI classifiers do not necessarily differentiate between, for example, YouTube traffic that arises from browsing inside the YouTube app, and traffic arising from the actual viewing of a YouTube video. Here we apply unsupervised clustering methods on such cellular DPI-labeled VoIP and video traffic to identify the characteristic behavior of the two subgroups of media-transfer and non media-transfer flows. The analysis is based on a measurement campaign performed inside the core network of a commercial cellular operator, collecting data for more than two billion packets in 40+ million flows. A specially instrumented commercial DPI appliance allows the simultaneous collection of per packet information in addition to the DPI classification output. We show that the majority of flows falls into clusters that are easily identifiable as belonging to one of the traffic subgroups , and that a surprising majority of DPIlabeled VoIP and video traffic is non-media related.

Towards Video Flow Classification at a Million Encrypted Flows Per Second

“…Both these actions would be labeled as YouTube by the DPI, but if the objective is to detect flows that perform actual video transfer such ground truth does not provide the optimal training. Utilizing unsupervised machine learning to improve the quality of the DPI training labels has been initially explored for a smaller data set in [17], and further elaborated for the current data set in [18].…”

Unveiling Radio Resource Utilization Dynamics of Mobile Traffic through Unsupervised Learning

“…At this point, the dissimilarity associated with two sessions is defined as the Euclidean distance between the two related points in the aforementioned hyperplane. Indeed, the optimal value of K is calculated in order to ensure that the intra-cluster distances are minimized and the inter-cluster distances are maximized [14] (note that, according to K-means terminology, this means that the silhouette [15] is maximized). Finally, the clustering process provides in output the sessions of each cluster and a special point of the hyperplane, namely centroid, that identifies the cluster itself.…”