Abstract:In recent years, traffic classification based on machine learning shows a high accuracy.Nevertheless, machine learning-based traffic classification heavily depends on the environment where the samples are trained.In practice, although a classifier can be accurately trained at a given network environment, its accuracy will see a great decline when it faces to classify traffic from varying network condition in practice.Due to dynamic changes of traffic statistics and distribution, the machine learning-based classifiers should be updated periodically in order to optimize the performance.This issue is unavoidable for machine learning-based traffic classification.The present solutions lack explicit recommendations on when a classifier should be updated and how to effectively update the classifier.These result in several shortcomings: (1) Updating a traditional traffic classifier is time consuming.It is inherent to how often a classifier should be updated or when a new classifier will be needed.(2) Updating only a new classifier on new traffic leads to some learned knowledge lost.It further affects the performance when updating a classifier on a large dataset that combines all collected data.(3) Traffic statistics and distribution from varying network condition are dynamically changed.Thus, it is hard to obtain stable feature subset to build robust classifier.Therefore, building an adaptive classifier to changing network condition is a huge challenge.In this paper, we develop an adaptive traffic classification using entropy-based detection and incremental ensemble learning, assisted with embedded feature selection.In order to update the classifier timely and effectively, the entropy-based detection utilizes sliding window technique to measure the statistical difference between the previous and current traffic samples by counting and comparing all instances with respect to their feature stream membership.Additionally, we discretize the range of feature values to a fixed number of bins to take the approximate value distribution into account.Moreover, incremental ensemble learning schema retains previous trained classifiers, and introduces the classifier retrained on current traffic and removes the classifier with performance degradation.Furthermore, several feature selectors are integrated to obtain feature subsets with robust generalization.The comprehensive performance evaluation conducted on two real-world network traffic data sets shows that our approach can effectively detect concept drift in changing network condition and update the classifier with high accuracy and generalization ability.The major contributions of this work are summarized as follows: first, this paper presents an adaptive traffic classification system based on concept drift detection.Information entropy is used to detect concept drift based on the entropy change of feature attributes.The information entropy-based detection method does not require class information of flows.Second, the classifiers are updated according to the result of concept drift detection, rather than regularly updated at a given period.Third, the method uses ensemble learning strategy to introduce classifier built on new samples, and eliminates classifiers with performance degradation in order to optimize the classification model.Fourth, mutual information is introduced to evaluate features for concept drift detection.The results show that the mutual information between packet size and protocol is high and stable, which indicates that the feature is suitable for concept drift detection.Fifth, this paper uses Hoeffding boundary to determine the window size of concept drift detection.The appropriate window size is significant for fast and effective concept drift detection.

Mobile App Traffic Flow Feature Extraction and Selection for Improving Classification Robustness

Adaptive Learning on Mobile Network Traffic Data.

Optimizing Traffic Classification Using Hybrid Feature Selection

FEAML: A Mobile Traffic Classification System with Feature Expansion and Autonomous Machine Learning.

Supervised Learning Real-time Traffic Classifiers

Feature selection for optimizing traffic classification

An Effective RTRC-TFD Method for Detecting Traffic Flow Using Data Stream Mining

An Adaptive Classification Approach Based on Information Entropy for Network Traffic in Presence of Concept Drift

An Effective Network Traffic Classification Method with Unknown Flow Detection

Robust Feature Selection for IM Applications at Early Stage Traffic Classification Using Machine Learning Algorithms

Robust network traffic identification with unknown applications.

A Better Algorithm for Classifying Data Streams with Concept Drifting

Estimating Traffic Flow States with Smart Phone Sensor Data

Multiscale Drift Detection Test to Enable Fast Learning in Nonstationary Environments

Classifying Imbalanced Internet Traffic Based PCDD

Network Traffic Classification Using Tri-training Based on Statistical Flow Characteristics

Trigger Relationship Aware Mobile Traffic Classification

Real Network Traffic Collection and Deep Learning for Mobile App Identification

Benchmark Data for Mobile App Traffic Research.

Move Statistics-Based Traffic Classifiers Online

Efficient and Robust Feature Extraction and Selection for Traffic Classification.