Automated Traffic Classification and Application Identification using Machine Learning

Authors:
Sebastian Zander;Thuy Nguyen;Grenville Armitage
Affiliations:
Swinburne University of Technology, Melbourne;Swinburne University of Technology, Melbourne;Swinburne University of Technology, Melbourne
Venue:
LCN '05 Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary
Year:
2005

Citing 0
Cited 55

Traffic classification using clustering algorithms

Proceedings of the 2006 SIGCOMM workshop on Mining network data
A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

ACM SIGCOMM Computer Communication Review
Automated network games enhancement layer: a proposed architecture

NetGames '06 Proceedings of 5th ACM SIGCOMM workshop on Network and system support for games
Identifying and discriminating between web and peer-to-peer traffic in the network core

Proceedings of the 16th international conference on World Wide Web
Offline/realtime traffic classification using semi-supervised learning

Performance Evaluation
802.11 user fingerprinting

Proceedings of the 13th annual ACM international conference on Mobile computing and networking
Performance analysis of the ANGEL system for automated control of game traffic prioritisation

Proceedings of the 6th ACM SIGCOMM workshop on Network and system support for games
A generic language for application-specific flow sampling

ACM SIGCOMM Computer Communication Review
Unconstrained endpoint profiling (googling the internet)

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Reliable Probabilistic Classification and Its Application to Internet Traffic

ICIC '08 Proceedings of the 4th international conference on Intelligent Computing: Advanced Intelligent Computing Theories and Applications - with Aspects of Theoretical and Methodological Issues
Traffic analysis of mobile broadband networks

WICON '07 Proceedings of the 3rd international conference on Wireless internet
Empirical Analysis of Application-Level Traffic Classification Using Supervised Machine Learning

APNOMS '08 Proceedings of the 11th Asia-Pacific Symposium on Network Operations and Management: Challenges for Next Generation Network Operations and Service Management
Online hybrid traffic classifier for Peer-to-Peer systems based on network processors

Applied Soft Computing
Characterizing network traffic by means of the NetMine framework

Computer Networks: The International Journal of Computer and Telecommunications Networking
Profiling and identification of P2P traffic

Computer Networks: The International Journal of Computer and Telecommunications Networking
Automatic discovery of botnet communities on large-scale communication networks

Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
Internet traffic classification demystified: myths, caveats, and the best practices

CoNEXT '08 Proceedings of the 2008 ACM CoNEXT Conference
Online Classification of Network Flows

CNSR '09 Proceedings of the 2009 Seventh Annual Communication Networks and Services Research Conference
Real Time Identification of SSH Encrypted Application Flows by Using Cluster Analysis Techniques

NETWORKING '09 Proceedings of the 8th International IFIP-TC 6 Networking Conference
Review: Application classification using packet size distribution and port association

Journal of Network and Computer Applications
Browser Fingerprinting from Coarse Traffic Summaries: Techniques and Implications

DIMVA '09 Proceedings of the 6th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
On the impacts of human interactions in MMORPG traffic

Multimedia Tools and Applications
Discriminating internet applications based on multiscale analysis

NGI'09 Proceedings of the 5th Euro-NGI conference on Next Generation Internet networks
A novel self-learning architecture for p2p traffic classification in high speed networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Composite lightweight traffic classification system for network management

International Journal of Network Management
On the validation of traffic classification algorithms

PAM'08 Proceedings of the 9th international conference on Passive and active network measurement
Network traffic classification based on error-correcting output codes and NN ensemble

FSKD'09 Proceedings of the 6th international conference on Fuzzy systems and knowledge discovery - Volume 3
Impact of asymmetric routing on statistical traffic classification

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Internet application traffic classification using fixed IP-port

APNOMS'09 Proceedings of the 12th Asia-Pacific network operations and management conference on Management enabling the future internet for changing business and new computing services
Estimating routing symmetry on single links by passive flow measurements

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
Googling the internet: profiling internet endpoints via the world wide web

IEEE/ACM Transactions on Networking (TON)
A framework for tunneled traffic analysis

ICACT'10 Proceedings of the 12th international conference on Advanced communication technology
Network prefix-level traffic profiling: Characterizing, modeling, and evaluation

Computer Networks: The International Journal of Computer and Telecommunications Networking
Internet traffic classification demystified: on the sources of the discriminative power

Proceedings of the 6th International COnference
Analysis of the impact of sampling on NetFlow traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
SMILER: Towards Practical Online Traffic Classification

Proceedings of the 2011 ACM/IEEE Seventh Symposium on Architectures for Networking and Communications Systems
Session level flow classification by packet size distribution and session grouping

Computer Networks: The International Journal of Computer and Telecommunications Networking
K-dimensional trees for continuous traffic classification

TMA'10 Proceedings of the Second international conference on Traffic Monitoring and Analysis
Realtime classification for encrypted traffic

SEA'10 Proceedings of the 9th international conference on Experimental Algorithms
Generating regular expression signatures for network traffic classification in trusted network management

Journal of Network and Computer Applications
Network flow classification based on the rhythm of packets

ICONIP'11 Proceedings of the 18th international conference on Neural Information Processing - Volume Part II
Challenges in network application identification

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
Internet traffic classification using multifractal analysis approach

Proceedings of the 15th Communications and Networking Simulation Symposium
Machine learning-based classification of encrypted internet traffic

MLDM'12 Proceedings of the 8th international conference on Machine Learning and Data Mining in Pattern Recognition
Exploiting packet-sampling measurements for traffic characterization and classification

International Journal of Network Management
Timely and continuous machine-learning-based classification for interactive IP traffic

IEEE/ACM Transactions on Networking (TON)
High throughput and programmable online trafficclassifier on FPGA

Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays
Unsupervised traffic classification using flow statistical properties and IP packet payload

Journal of Computer and System Sciences
A learning system for discriminating variants of malicious network traffic

Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop
Who do you sync you are?: smartphone fingerprinting via application behaviour

Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)
Robust network traffic identification with unknown applications

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
Online NetFPGA decision tree statistical traffic classifier

Computer Communications
Protocol misidentification made easy with format-transforming encryption

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Application of Bayesian Networks for Autonomic Network Management

Journal of Network and Systems Management

Quantified Score

Hi-index	0.00

Visualization

Abstract

The dynamic classification and identification of network applications responsible for network traffic flows offers substantial benefits to a number of key areas in IP network engineering, management and surveillance. Currently such classifications rely on selected packet header fields (e.g. port numbers) or application layer protocol decoding. These methods have a number of shortfalls e.g. many applications can use unpredictable port numbers and protocol decoding requires a high amount of computing resources or is simply infeasible in case protocols are unknown or encrypted. We propose a novel method for traffic classification and application identification using an unsupervised machine learning technique. Flows are automatically classified based on statistical flow characteristics. We evaluate the efficiency of our approach using data from several traffic traces collected at different locations of the Internet. We use feature selection to find an optimal feature set and determine the influence of different features.