SeLeCT: Self-Learning Classifier for Internet Traffic

Abstract

Network visibility is a critical part of traffic engineering, network management, and security. The most popular current solutions -Deep Packet Inspection (DPI) and statistical classification, deeply rely on the availability of a training set. Besides the cumbersome need to regularly update the signatures, their visibility is limited to classes the classifier has been trained for. Unsupervised algorithms have been envisioned as a viable alternative to automatically identify classes of traffic. However, the accuracy achieved so far does not allow to use them for traffic classification in practical scenario.To address the above issues, we propose SeLeCT, a Self-Learning Classifier for Internet Traffic. It uses unsupervised algorithms along with an adaptive seeding approach to automatically let classes of traffic emerge, being identified and labeled. Unlike traditional classifiers, it requires neither a-priori knowledge of signatures nor a training set to extract the signatures. Instead, SeLeCT automatically groups flows into pure (or homogeneous) clusters using simple statistical features. SeLeCT simplifies label assignment (which is still based on some manual intervention) so that proper class labels can be easily discovered. Furthermore, SeLeCT uses an iterative seeding approach to boost its ability to cope with new protocols and applications.We evaluate the performance of SeLeCT using traffic traces collected in different years from various ISPs located in 3 different continents. Our experiments show that SeLeCT achieves excellent precision and recall, with overall accuracy close to 98%. Unlike state-of-art classifiers, the biggest advantage of SeLeCT is its ability to discover new protocols and applications in an almost automated fashion.

Deep learning–based network application classification for SDN

“…To achieve accurate network applications, a large number of different application classification methods have been proposed in the past few decades, mainly including port‐based approach, payload‐based approach, and machine learning–based approach . In current years, the most widely used technology for application classification is the machine learning–based approach, in which backpropagation (BP) neural network, Bayesian network, support vector machine (SVM), and C4.5 decision tree are usually applied to the classification …”

“…2 In current years, the most widely used technology for application classification is the machine learning-based approach, in which backpropagation (BP) neural network, Bayesian network, support vector machine (SVM), and C4.5 decision tree are usually applied to the classification. [3][4][5][6][7][8][9][10][11] Different from identifying port number in the port-based approach as well as inspecting payload content in the payload-based approach, in machine learning-based classification methods, the flow features statistics, including the size of packet, interpacket time, and flow duration time, are used to automatically identify and classify network application by using machine learning. The shallow neural network is generally used to build the application classifier in lots of machine learning-based classification methods.…”

Resource management for symmetrical applications over heterogeneous services in IEEE 802.16

“…Packet classification has attracted myriad of research efforts throughout decades because it has strong potential to solve many difficult problems in network security and management but most of the research activities stressed on the classification issues [22][23][24][25][26] and little attention has been given to the sequence of packet classification. Nevertheless, this is an important issue because it affects the queues, scheduling, and subsequently the QoS performance.…”

Internet Traffic Classification for Faster and Secured Network Service

“…Various clustering algorithms are present which differs by their complexity. A new unsupervised algorithm called SeLeCT was proposed [1] for implementation over a large data set consisting of the traces collected in different years from various ISPs located in 3 different continents. SeLeCT gives good level of system deceivability for disclosure of new classes of activity for system administration.…”