Abstract:Timely traffic identification is critical in network security monitoring and traffic engineering. Traditional methods using well-known ports, protocols and precise signature matching are no longer accurate with the proliferation of new applications. Recently, applying pattern recognition methods to classify network application traffic based on the flow parameters (e.g. port, flow duration, etc.) has become increasing popular. However, many methods developed in the previous works are either too complex to be applied in real-time, or suffer from lower accuracy due to the insufficient knowledge of the application. In this paper, we first give an overview on the developments of pattern recognition methods as traffic classification tools. We then develop two separate pattern recognition methods: one with supervised learning, and one with un-supervised learning, and apply them to classify traffic captured from a campus backbone network. The supervised learning method (an optimized SVM method) yields approximately 99.41 % accuracy for the collected traffic. The un-supervised learning method (an entropy based clustering method) gets the average accuracy of 92.41% for the top 20 traffic generating hosts during the same time period. Performance test on a single PC with 3GHz Pentium 4 processors and 1 GB of memory show that both methods can handle more than 10000 network flows per second, close to real time requirements for many situations.

Supervised Learning Real-time Traffic Classifiers

Machine Learned Real-Time Traffic Classifiers

Realtime traffic classification based on semi-supervised learning

Traffic Classification - Towards Accurate Real Time Network Applications

Move Statistics-Based Traffic Classifiers Online

A Statistical-Feature-based Approach to Internet Traffic Classification Using Machine Learning.

Study on Internet Traffic Classification Using Machine Learning

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

Advances in Machine Learning Based Network Traffic Classification

An Effective Network Traffic Classification Method with Unknown Flow Detection

A traffic classification approach based on characteristics of subflows and ensemble learning

Online automatic traffic classification architecture in access network

Internet Traffic Classification Using Machine Learning: A Token-based Approach

Semi-supervised and Compound Classification of Network Traffic

Traffic Classification Combining Flow Correlation and Ensemble Classifier.

Network Traffic Classification Using Tri-training Based on Statistical Flow Characteristics

An Automated On-line Traffic Flow Classification Scheme

An Internet Traffic Classification Method Based on Semi-Supervised Support Vector Machine

Feature selection for optimizing traffic classification

A Self-Adaptive Network Traffic Classification System with Unknown Flow Detection

Machine learning based network traffic classification: a survey