Clustering Techniques for Traffic Classification: A Comprehensive Review

Abstract

The threat of malicious content on a network requires network administrators and users to accurately detect desirable traffic flow into their respective networks. To this effect, several studies have found it imperative to classify traffic flow, and to use traffic classification in various applications such as intrusion detection, monitoring systems, as well as pattern detection in various networks. Research into machine learning techniques of clustering emerged due to the inefficiencies and drawbacks of the traditional port-based and payload-based schemes. The classic Kmeans technique of clustering, in combination with other methods and parameters, can be used to build newer unsupervised and semi-supervised approaches to meliorate the quality of service in networks. In this paper, we review twelve of the existing clustering techniques. The review covers their contribution to clustering methods, the existing challenges, as well as recommendations for further research in clustering traffic flows.

Online traffic classification for malicious flows using efficient machine learning techniques

“…However, the effectiveness of these methods also has greatly reduced due to the fact that the customers use encrypted flows, while governments decided to band to have third parties to involve in the system to examine payloads for safety purposes. In addition, the inspection process of packets payload syntax could give a heavy operational load and delay [9].…”

“…This approach has become popular as encrypting traffic of applications becoming a new trend that causes challenges for any of the proposed classification tools that previously claimed to be able to achieve high accuracy in applications classification. However, the accuracy might drop if the training data is insufficient as high amount of data is needed as learning process [4], [9]. In Weka [19], various ML algorithms are tested and compared.…”

“…Network traffic classification [4], [5] is flows identification of the network traffic and positioning each of the flows to various classes according to their feature information like port number [6], [7], TELKOMNIKA Telecommun Comput El Control  Online traffic classification for malicious flows using efficient machine learning techniques (YingYenn Chan) 1397 payload [8]- [11], [12], traffic behaviours [13]- [16] and flow information [4], [8], [9], [12], [17]. In this paper, an efficient flow information based classification of suspicious network traffic flow is introduced.…”

Vision-Based Potential Pedestrian Risk Analysis on Unsignalized Crosswalk Using Data Mining Techniques

“…K-means clustering: Clustering techniques consist of unsupervised and semi-supervised learning methods and are mainly used to handle the associations of some characteristic features [28]. In this study, we considered each frame with its extracted features as a record, and used k-means clustering to classify them into categories which could indicate degrees of risk.…”