Efficient, Accurate Internet Traffic Classification using Discretization in Naive Bayes

Liu, Yuhai; Li, Zhiqiang; Guo, Shanqing; Feng, Taiming

doi:10.1109/icnsc.2008.4525474

Cited by 2 publications

(1 citation statement)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Discretization has already been shown to work well for Naive Bayes and SVM in multiple areas of various pattern classification problems, since it does not make assumptions about the form of the probability distribution from which the quantitative feature values were drawn, particularly for Naive Bayes [24,11,51,33,5]. This paper empirically confirms that the entropy-based discretization (and even the simplest Equal-Interval-Width discretization, though the results are omitted due to lack of space) does the same for traffic classification as well, with ports and the sizes of the first few consecutive packets in a single-directional flow.…”

Section: Conclusion: Why Discretization?mentioning

confidence: 99%

Internet traffic classification demystified

Lim

Kim

Jeong

et al. 2010

Proceedings of the 6th International COnference

101

View full text Add to dashboard Cite

Recent research on Internet traffic classification has yield a number of data mining techniques for distinguishing types of traffic, but no systematic analysis on "Why" some algorithms achieve high accuracies. In pursuit of empirically grounded answers to the "Why" question, which is critical in understanding and establishing a scientific ground for traffic classification research, this paper reveals the three sources of the discriminative power in classifying the Internet application traffic: (i) ports, (ii) the sizes of the first one-two (for UDP flows) or four-five (for TCP flows) packets, and (iii) discretization of those features. We find that C4.5 performs the best under any circumstances, as well as the reason why; because the algorithm discretizes input features during classification operations. We also find that the entropy-based Minimum Description Length discretization on ports and packet size features substantially improve the classification accuracy of every machine learning algorithm tested (by as much as 59.8%!) and make all of them achieve >93% accuracy on average without any algorithm-specific tuning processes. Our results indicate that dealing with the ports and packet size features as discrete nominal intervals, not as continuous numbers, is the essential basis for accurate traffic classification (i.e., the features should be discretized first), regardless of classification algorithms to use. load bytes of each packet is required to identify 90% of the Gnutella flows using payload signatures [15].

show abstract

Section: Conclusion: Why Discretization?mentioning

confidence: 99%