A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

Authors:
Nigel Williams;Sebastian Zander;Grenville Armitage
Affiliations:
Swinburne University of Technology, Melbourne, Australia;Swinburne University of Technology, Melbourne, Australia;Swinburne University of Technology, Melbourne, Australia
Venue:
ACM SIGCOMM Computer Communication Review
Year:
2006

Citing 10
Cited 68

A Comparison of Prediction Accuracy, Complexity, and Training Time of Thirty-Three Old and New Classification Algorithms

Machine Learning
Machine Learning

Machine Learning
Data mining tasks and methods: Classification: decision-tree discovery

Handbook of data mining and knowledge discovery
Consistency-based search in feature selection

Artificial Intelligence
Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Internet traffic classification using bayesian analysis techniques

SIGMETRICS '05 Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Automated Traffic Classification and Application Identification using Machine Learning

LCN '05 Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary
Traffic classification on the fly

ACM SIGCOMM Computer Communication Review
Estimating continuous distributions in Bayesian classifiers

UAI'95 Proceedings of the Eleventh conference on Uncertainty in artificial intelligence

Byte me: a case for byte accuracy in traffic classification

Proceedings of the 3rd annual ACM workshop on Mining network data
Offline/realtime traffic classification using semi-supervised learning

Performance Evaluation
Processing forecasting queries

VLDB '07 Proceedings of the 33rd international conference on Very large data bases
Performance analysis of the ANGEL system for automated control of game traffic prioritisation

Proceedings of the 6th ACM SIGCOMM workshop on Network and system support for games
A generic language for application-specific flow sampling

ACM SIGCOMM Computer Communication Review
Reliable Probabilistic Classification and Its Application to Internet Traffic

ICIC '08 Proceedings of the 4th international conference on Intelligent Computing: Advanced Intelligent Computing Theories and Applications - with Aspects of Theoretical and Methodological Issues
Traffic flooding attack detection with SNMP MIB using SVM

Computer Communications
Acceleration of decision tree searching for IP traffic classification

Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
Empirical Analysis of Application-Level Traffic Classification Using Supervised Machine Learning

APNOMS '08 Proceedings of the 11th Asia-Pacific Symposium on Network Operations and Management: Challenges for Next Generation Network Operations and Service Management
Pattern Recognition Approaches for Classifying IP Flows

SSPR & SPR '08 Proceedings of the 2008 Joint IAPR International Workshop on Structural, Syntactic, and Statistical Pattern Recognition
A Wavelet-Based Model to Recognize High-Quality Topics on Web Forum

WI-IAT '08 Proceedings of the 2008 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology - Volume 01
Efficient application identification and the temporal and spatial stability of classification schema

Computer Networks: The International Journal of Computer and Telecommunications Networking
Profiling and identification of P2P traffic

Computer Networks: The International Journal of Computer and Telecommunications Networking
Automatic discovery of botnet communities on large-scale communication networks

Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
Rapid identification of Skype traffic flows

Proceedings of the 18th international workshop on Network and operating systems support for digital audio and video
Internet traffic classification demystified: myths, caveats, and the best practices

CoNEXT '08 Proceedings of the 2008 ACM CoNEXT Conference
Online Classification of Network Flows

CNSR '09 Proceedings of the 2009 Seventh Annual Communication Networks and Services Research Conference
TIE: A Community-Oriented Traffic Classification Platform

TMA '09 Proceedings of the First International Workshop on Traffic Monitoring and Analysis
Identify P2P Traffic by Inspecting Data Transfer Behaviour

NETWORKING '09 Proceedings of the 8th International IFIP-TC 6 Networking Conference
Classifying SSH encrypted traffic with minimum packet header features using genetic programming

Proceedings of the 11th Annual Conference Companion on Genetic and Evolutionary Computation Conference: Late Breaking Papers
Regularized Linear Models in Stacked Generalization

MCS '09 Proceedings of the 8th International Workshop on Multiple Classifier Systems
Support Vector Machines for TCP traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Challenging statistical classification for operational usage: the ADSL case

Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
Website fingerprinting: attacking popular privacy enhancing technologies with the multinomial naïve-bayes classifier

Proceedings of the 2009 ACM workshop on Cloud computing security
Traffic Behaviour Characterization Using NetMate

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Per flow packet sampling for high-speed network monitoring

COMSNETS'09 Proceedings of the First international conference on COMmunication Systems And NETworks
Machine learning based encrypted traffic classification: identifying SSH and skype

CISDA'09 Proceedings of the Second IEEE international conference on Computational intelligence for security and defense applications
Decision tree network traffic classifier via adaptive hierarchical clustering for imperfect training dataset

WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
A novel self-learning architecture for p2p traffic classification in high speed networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Machine learning algorithms for accurate flow-based network traffic classification: Evaluation and comparison

Performance Evaluation
Identify P2P traffic by inspecting data transfer behavior

Computer Communications
Impact of asymmetric routing on statistical traffic classification

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
An experimental evaluation of the computational cost of a DPI traffic classifier

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Hybrid traffic classification approach based on decision tree

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
LCGT: a low-cost continuous ground truth generation method for traffic classification

APNOMS'09 Proceedings of the 12th Asia-Pacific network operations and management conference on Management enabling the future internet for changing business and new computing services
Using GMM and SVM-based techniques for the classification of SSH-encrypted traffic

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Discernibility analysis and accuracy improvement of machine learning algorithms for network intrusion detection

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Sensing foot gestures from the pocket

UIST '10 Proceedings of the 23nd annual ACM symposium on User interface software and technology
Relational network-service clustering analysis with set evidences

Proceedings of the 3rd ACM workshop on Artificial intelligence and security
Internet traffic classification demystified: on the sources of the discriminative power

Proceedings of the 6th International COnference
NeTraMark: a network traffic classification benchmark

ACM SIGCOMM Computer Communication Review
Analysis of the impact of sampling on NetFlow traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Early classification of network traffic through multi-classification

TMA'11 Proceedings of the Third international conference on Traffic monitoring and analysis
Inferring users' online activities through traffic analysis

Proceedings of the fourth ACM conference on Wireless network security
UNADA: unsupervised network anomaly detection using sub-space outliers ranking

NETWORKING'11 Proceedings of the 10th international IFIP TC 6 conference on Networking - Volume Part I
Stealthier inter-packet timing covert channels

NETWORKING'11 Proceedings of the 10th international IFIP TC 6 conference on Networking - Volume Part I
Generalization and optimization of feature set for accurate identification of P2P Traffic in the internet using neural network

WSEAS TRANSACTIONS on COMMUNICATIONS
Session-based classification of internet applications in 3G wireless networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Using a behaviour knowledge space approach for detecting unknown IP traffic flows

MCS'11 Proceedings of the 10th international conference on Multiple classifier systems
MINETRAC: mining flows for unsupervised analysis & semi-supervised classification

Proceedings of the 23rd International Teletraffic Congress
Session level flow classification by packet size distribution and session grouping

Computer Networks: The International Journal of Computer and Telecommunications Networking
Kiss to abacus: a comparison of P2P-TV traffic classifiers

TMA'10 Proceedings of the Second international conference on Traffic Monitoring and Analysis
A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

ACM Transactions on Knowledge Discovery from Data (TKDD)
Challenges in network application identification

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
Feature selection for optimizing traffic classification

Computer Communications
Analyzing characteristic host access patterns for re-identification of web user sessions

NordSec'10 Proceedings of the 15th Nordic conference on Information Security Technology for Applications
Machine learning-based classification of encrypted internet traffic

MLDM'12 Proceedings of the 8th international conference on Machine Learning and Data Mining in Pattern Recognition
An efficient fuzzy controller based technique for network traffic classification to improve QoS

Proceedings of the Fifth International Conference on Security of Information and Networks
Exploiting packet-sampling measurements for traffic characterization and classification

International Journal of Network Management
Timely and continuous machine-learning-based classification for interactive IP traffic

IEEE/ACM Transactions on Networking (TON)
High throughput and programmable online trafficclassifier on FPGA

Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays
A comparison of machine learning algorithms for proactive hard disk drive failure detection

Proceedings of the 4th international ACM Sigsoft symposium on Architecting critical systems
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)
Toward an efficient and scalable feature selection approach for internet traffic classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Online NetFPGA decision tree statistical traffic classifier

Computer Communications
Feature selection for detection of peer-to-peer botnet traffic

Proceedings of the 6th ACM India Computing Convention
Reviewing traffic classification

DataTraffic Monitoring and Analysis
Application of Bayesian Networks for Autonomic Network Management

Journal of Network and Systems Management

Quantified Score

Hi-index	0.00

Visualization

Abstract

The identification of network applications through observation of associated packet traffic flows is vital to the areas of network management and surveillance. Currently popular methods such as port number and payload-based identification exhibit a number of shortfalls. An alternative is to use machine learning (ML) techniques and identify network applications based on per-flow statistics, derived from payload-independent features such as packet length and inter-arrival time distributions. The performance impact of feature set reduction, using Consistency-based and Correlation-based feature selection, is demonstrated on Naïve Bayes, C4.5, Bayesian Network and Naïve Bayes Tree algorithms. We then show that it is useful to differentiate algorithms based on computational performance rather than classification accuracy alone, as although classification accuracy between the algorithms is similar, computational performance can differ significantly.