Internet traffic classification demystified

Abstract

Recent research on Internet traffic classification has yield a number of data mining techniques for distinguishing types of traffic, but no systematic analysis on "Why" some algorithms achieve high accuracies. In pursuit of empirically grounded answers to the "Why" question, which is critical in understanding and establishing a scientific ground for traffic classification research, this paper reveals the three sources of the discriminative power in classifying the Internet application traffic: (i) ports, (ii) the sizes of the first one-two (for UDP flows) or four-five (for TCP flows) packets, and (iii) discretization of those features. We find that C4.5 performs the best under any circumstances, as well as the reason why; because the algorithm discretizes input features during classification operations. We also find that the entropy-based Minimum Description Length discretization on ports and packet size features substantially improve the classification accuracy of every machine learning algorithm tested (by as much as 59.8%!) and make all of them achieve >93% accuracy on average without any algorithm-specific tuning processes. Our results indicate that dealing with the ports and packet size features as discrete nominal intervals, not as continuous numbers, is the essential basis for accurate traffic classification (i.e., the features should be discretized first), regardless of classification algorithms to use. load bytes of each packet is required to identify 90% of the Gnutella flows using payload signatures [15].

A Novel Distributed Stack Ensembled Meta-Learning-Based Optimized Classification Framework for Real-time Prolific IoT Traffic Streams

“…web applications, Peer-to-Peer, DNS, SMTP, Gaming, etc.) [28,34]. However, the work towards IoT device identification and classification is in inception.…”

A streaming flow-based technique for traffic classification applied to 12 + 1 years of Internet traffic

“…For this comparison, we chose the J48 technique as a representative example of batch-oriented techniques, which is an open source version of the C4.5 decision tree implemented in WEKA. We selected this technique because it has been widely used for network traffic classification [5,6,12,29], achieving very good results when compared with other techniques [4,30]. Usually ML-based network traffic classification solutions presented in the literature are evaluated from a static point of view using limited datasets.…”

“…State-of-the-art proposals for traffic classification are usually based on Deep Packet Inspection (DPI) or Machine Learning (ML) techniques [2][3][4][5][6][7][8][9]. These techniques extract in an offline phase a set of patterns, rules or models that capture a static view of a particular network and moment of time from a training dataset.…”

Auto Adaptive Identification Algorithm Based on Network Traffic Flow

“…With appearance of the new service, the method of machine learning has been applied to the traffic identification. Identify fields on the flow, roughly divided into three research directions: one is the feature selection algorithm [7,8], the other is identification algorithm [1,2,9], another is a category for different types of data sets, for example, all packets can be divided into flows [10][11][12][13][14] that are sampling NETFLOW [15]. Complementary information about related work in the field of traffic identification can be found in the survey of traffic identification techniques using machine learning in [16], in the comparison of contemporary classification methods in [13], the survey on Inter-net traffic identification in [17] and the research review on traffic identification in [18].…”