Self-Learning IP traffic classification based on statistical flow characteristics

Authors:
Sebastian Zander;Thuy Nguyen;Grenville Armitage
Affiliations:
Centre for Advanced Internet Architectures (CAIA), Swinburne University of Technology, Melbourne, Australia;Centre for Advanced Internet Architectures (CAIA), Swinburne University of Technology, Melbourne, Australia;Centre for Advanced Internet Architectures (CAIA), Swinburne University of Technology, Melbourne, Australia
Venue:
PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement
Year:
2005

Citing 3
Cited 15

Bayesian classification (AutoClass): theory and results

Advances in knowledge discovery and data mining
Accurate, scalable in-network identification of p2p traffic using application signatures

Proceedings of the 13th international conference on World Wide Web
Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement

ACAS: automated construction of application signatures

Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
Unexpected means of protocol inference

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Lightweight application classification for network management

Proceedings of the 2007 SIGCOMM workshop on Internet network management
Identify P2P Traffic by Inspecting Data Transfer Behaviour

NETWORKING '09 Proceedings of the 8th International IFIP-TC 6 Networking Conference
Learning on class imbalanced data to classify peer-to-peer applications in IP traffic using resampling techniques

IJCNN'09 Proceedings of the 2009 international joint conference on Neural Networks
A novel self-learning architecture for p2p traffic classification in high speed networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Improving cost and accuracy of DPI traffic classifiers

Proceedings of the 2010 ACM Symposium on Applied Computing
Identify P2P traffic by inspecting data transfer behavior

Computer Communications
An experimental evaluation of the computational cost of a DPI traffic classifier

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Network prefix-level traffic profiling: Characterizing, modeling, and evaluation

Computer Networks: The International Journal of Computer and Telecommunications Networking
Optimizing Deep Packet Inspection for High-Speed Traffic Analysis

Journal of Network and Systems Management
Analysis of the impact of sampling on NetFlow traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Network traffic classification using a parallel neural network classifier architecture

Proceedings of the Seventh Annual Workshop on Cyber Security and Information Intelligence Research
Classification of Peer-to-Peer Traffic Using A Two-Stage Window-Based Classifier With Fast Decision Tree and IP Layer Attributes

International Journal of Data Warehousing and Mining
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

A number of key areas in IP network engineering, management and surveillance greatly benefit from the ability to dynamically identify traffic flows according to the applications responsible for their creation. Currently such classifications rely on selected packet header fields (e.g. destination port) or application layer protocol decoding. These methods have a number of shortfalls e.g. many applications can use unpredictable port numbers and protocol decoding requires high resource usage or is simply infeasible in case protocols are unknown or encrypted. We propose a framework for application classification using an unsupervised machine learning (ML) technique. Flows are automatically classified based on their statistical characteristics. We also propose a systematic approach to identify an optimal set of flow attributes to use and evaluate the effectiveness of our approach using captured traffic traces.