Traffic classification using clustering algorithms

Authors:
Jeffrey Erman;Martin Arlitt;Anirban Mahanti
Affiliations:
University of Calgary, Calgary, AB, Canada;University of Calgary, Calgary, AB, Canada;University of Calgary, Calgary, AB, Canada
Venue:
Proceedings of the 2006 SIGCOMM workshop on Mining network data
Year:
2006

Citing 13
Cited 77

Algorithms for clustering data

Algorithms for clustering data
Empirically derived analytic models of wide-area TCP connections

IEEE/ACM Transactions on Networking (TON)
Bayesian classification (AutoClass): theory and results

Advances in knowledge discovery and data mining
An analysis of Internet chat systems

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Accurate, scalable in-network identification of p2p traffic using application signatures

Proceedings of the 13th international conference on World Wide Web
Transport layer identification of P2P traffic

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Internet traffic classification using bayesian analysis techniques

SIGMETRICS '05 Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
ACAS: automated construction of application signatures

Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
Automated Traffic Classification and Application Identification using Machine Learning

LCN '05 Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary
Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)

Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)
Toward the accurate identification of network applications

PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement

Identifying and discriminating between web and peer-to-peer traffic in the network core

Proceedings of the 16th international conference on World Wide Web
Semi-supervised network traffic classification

Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Offline/realtime traffic classification using semi-supervised learning

Performance Evaluation
NetADHICT: a tool for understanding network traffic

LISA'07 Proceedings of the 21st conference on Large Installation System Administration Conference
WMHAS model for improvement document classification

ICCOMP'07 Proceedings of the 11th WSEAS International Conference on Computers
An adaptive anomaly detector for worm detection

SYSML'07 Proceedings of the 2nd USENIX workshop on Tackling computer systems problems with machine learning techniques
Early application identification

CoNEXT '06 Proceedings of the 2006 ACM CoNEXT conference
Unconstrained endpoint profiling (googling the internet)

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Context-aware clustering of DNS query traffic

Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
A data mining approach for analysis of worm activity through automatic signature generation

Proceedings of the 1st ACM workshop on Workshop on AISec
Empirical Analysis of Application-Level Traffic Classification Using Supervised Machine Learning

APNOMS '08 Proceedings of the 11th Asia-Pacific Symposium on Network Operations and Management: Challenges for Next Generation Network Operations and Service Management
Characterizing network traffic by means of the NetMine framework

Computer Networks: The International Journal of Computer and Telecommunications Networking
Efficient application identification and the temporal and spatial stability of classification schema

Computer Networks: The International Journal of Computer and Telecommunications Networking
Behavioural Characterization for Network Anomaly Detection

Transactions on Computational Science IV
Internet traffic classification demystified: myths, caveats, and the best practices

CoNEXT '08 Proceedings of the 2008 ACM CoNEXT Conference
Online Classification of Network Flows

CNSR '09 Proceedings of the 2009 Seventh Annual Communication Networks and Services Research Conference
GTVS: Boosting the Collection of Application Traffic Ground Truth

TMA '09 Proceedings of the First International Workshop on Traffic Monitoring and Analysis
Revealing the Unknown ADSL Traffic Using Statistical Methods

TMA '09 Proceedings of the First International Workshop on Traffic Monitoring and Analysis
On the stability of the information carried by traffic flow features at the packet level

ACM SIGCOMM Computer Communication Review
Classifying SSH encrypted traffic with minimum packet header features using genetic programming

Proceedings of the 11th Annual Conference Companion on Genetic and Evolutionary Computation Conference: Late Breaking Papers
GT: picking up the truth from the ground for internet traffic

ACM SIGCOMM Computer Communication Review
Challenging statistical classification for operational usage: the ADSL case

Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
Exploiting dynamicity in graph-based traffic analysis: techniques and applications

Proceedings of the 5th international conference on Emerging networking experiments and technologies
Discriminating internet applications based on multiscale analysis

NGI'09 Proceedings of the 5th Euro-NGI conference on Next Generation Internet networks
Traffic Classification Based on Flow Similarity

IPOM '09 Proceedings of the 9th IEEE International Workshop on IP Operations and Management
Statistical texture analysis methods for network traffic classification

AsiaCSN '07 Proceedings of the Fourth IASTED Asian Conference on Communication Systems and Networks
Detection of illicit traffic based on multiscale analysis

SoftCOM'09 Proceedings of the 17th international conference on Software, Telecommunications and Computer Networks
Graph-based P2P traffic classification at the internet backbone

INFOCOM'09 Proceedings of the 28th IEEE international conference on Computer Communications Workshops
Machine learning based encrypted traffic classification: identifying SSH and skype

CISDA'09 Proceedings of the Second IEEE international conference on Computational intelligence for security and defense applications
A novel self-learning architecture for p2p traffic classification in high speed networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Early recognition of encrypted applications

PAM'07 Proceedings of the 8th international conference on Passive and active network measurement
Composite lightweight traffic classification system for network management

International Journal of Network Management
On the validation of traffic classification algorithms

PAM'08 Proceedings of the 9th international conference on Passive and active network measurement
Better network traffic identification through the independent combination of techniques

Journal of Network and Computer Applications
An experimental evaluation of the computational cost of a DPI traffic classifier

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
A first look at traffic classification in enterprise networks

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
Bayesian classification: methodology for network traffic classification combination

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
Googling the internet: profiling internet endpoints via the world wide web

IEEE/ACM Transactions on Networking (TON)
Unsupervised host behavior classification from connection patterns

International Journal of Network Management
Relational network-service clustering analysis with set evidences

Proceedings of the 3rd ACM workshop on Artificial intelligence and security
The RIPE NCC internet measurement data repository

PAM'10 Proceedings of the 11th international conference on Passive and active measurement
Network prefix-level traffic profiling: Characterizing, modeling, and evaluation

Computer Networks: The International Journal of Computer and Telecommunications Networking
Internet traffic classification demystified: on the sources of the discriminative power

Proceedings of the 6th International COnference
An FPGA-based system for tracking digital information transmitted via Peer-to-Peer protocols

International Journal of Security and Networks
NeTraMark: a network traffic classification benchmark

ACM SIGCOMM Computer Communication Review
A VoIP Traffic Identification Scheme Based on Host and Flow Behavior Analysis

Journal of Network and Systems Management
Optimizing Deep Packet Inspection for High-Speed Traffic Analysis

Journal of Network and Systems Management
Properties and Evolution of Internet Traffic Networks from Anonymized Flow Data

ACM Transactions on Internet Technology (TOIT)
Quantifying the accuracy of the ground truth associated with Internet traffic traces

Computer Networks: The International Journal of Computer and Telecommunications Networking
Analysis of the impact of sampling on NetFlow traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Classification by clustering decision tree-like classifier based on adjusted clusters

Expert Systems with Applications: An International Journal
Classification by clustering decision tree-like classifier based on adjusted clusters

Expert Systems with Applications: An International Journal
Improving matching performance of DPI traffic classifier

Proceedings of the 2011 ACM Symposium on Applied Computing
Graption: A graph-based P2P traffic classification framework for the internet backbone

Computer Networks: The International Journal of Computer and Telecommunications Networking
Mining unclassified traffic using automatic clustering techniques

TMA'11 Proceedings of the Third international conference on Traffic monitoring and analysis
Using of time characteristics in data flow for traffic classification

AIMS'11 Proceedings of the 5th international conference on Autonomous infrastructure, management, and security: managing the dynamics of networks and services
Session-based classification of internet applications in 3G wireless networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
MINETRAC: mining flows for unsupervised analysis & semi-supervised classification

Proceedings of the 23rd International Teletraffic Congress
Self-adaptive QoS control mechanism in cognitive networks based on intelligent service awareness

WISM'11 Proceedings of the 2011 international conference on Web information systems and mining - Volume Part I
Uncovering relations between traffic classifiers and anomaly detectors via graph theory

TMA'10 Proceedings of the Second international conference on Traffic Monitoring and Analysis
Kiss to abacus: a comparison of P2P-TV traffic classifiers

TMA'10 Proceedings of the Second international conference on Traffic Monitoring and Analysis
Generating regular expression signatures for network traffic classification in trusted network management

Journal of Network and Computer Applications
Network traffic classification via HMM under the guidance of syntactic structure

Computer Networks: The International Journal of Computer and Telecommunications Networking
Real-Time traffic classification based on cosine similarity using sub-application vectors

TMA'12 Proceedings of the 4th international conference on Traffic Monitoring and Analysis
Iterative resource pooling for bandwidth allocation in TDM-PON: algorithm, convergence and experimental evaluation

Photonic Network Communications
A decision support method, based on bounded rationality concepts, to reveal feature saliency in clustering problems

Decision Support Systems
TrafficS: a behavior-based network traffic classification benchmark system with traffic sampling functionality

ICONIP'12 Proceedings of the 19th international conference on Neural Information Processing - Volume Part IV
Timely and continuous machine-learning-based classification for interactive IP traffic

IEEE/ACM Transactions on Networking (TON)
High throughput and programmable online trafficclassifier on FPGA

Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays
Unsupervised traffic classification using flow statistical properties and IP packet payload

Journal of Computer and System Sciences
Who do you sync you are?: smartphone fingerprinting via application behaviour

Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)
Robust network traffic identification with unknown applications

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
Toward an efficient and scalable feature selection approach for internet traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Synoptic graphlet: bridging the gap between supervised and unsupervised profiling of host-level network traffic

IEEE/ACM Transactions on Networking (TON)
Data clustering based on correlation analysis applied to highly variable domains

Computer Networks: The International Journal of Computer and Telecommunications Networking
Reviewing traffic classification

DataTraffic Monitoring and Analysis

Quantified Score

Hi-index	0.00

Visualization

Abstract

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult with many peer-to-peer (P2P) applications using dynamic port numbers, masquerading techniques, and encryption to avoid detection. An alternative approach is to classify traffic by exploiting the distinctive characteristics of applications when they communicate on a network. We pursue this latter approach and demonstrate how cluster analysis can be used to effectively identify groups of traffic that are similar using only transport layer statistics. Our work considers two unsupervised clustering algorithms, namely K-Means and DBSCAN, that have previously not been used for network traffic classification. We evaluate these two algorithms and compare them to the previously used AutoClass algorithm, using empirical Internet traces. The experimental results show that both K-Means and DBSCAN work very well and much more quickly then AutoClass. Our results indicate that although DBSCAN has lower accuracy compared to K-Means and AutoClass, DBSCAN produces better clusters.