Abstract:Network traffic classification is an essential component for network management and security systems. To address the limitations of traditional port-based and payload-based methods, recent studies have been focusing on alternative approaches. One promising direction is applying machine learning techniques to classify traffic flows based on packet and flow level statistics. In particular, previous papers have illustrated that clustering can achieve high accuracy and discover unknown application classes. In this work, we present a novel semi-supervised learning method using constrained clustering algorithms. The motivation is that in network domain a lot of background information is available in addition to the data instances themselves. For example, we might know that flow f1 and f2 are using the same application protocol because they are visiting the same host address at the same port simultaneously. In this case, f1 and f2 shall be grouped into the same cluster ideally. Therefore, we describe these correlations in the form of pair-wise must-link constraints and incorporate them in the process of clustering. We have applied three constrained variants of the K-Means algorithm, which perform hard or soft constraint satisfaction and metric learning from constraints. A number of real-world traffic traces have been used to show the availability of constraints and to test the proposed approach. The experimental results indicate that by incorporating constraints in the course of clustering, the overall accuracy and cluster purity can be significantly improved.

Unsupervised Traffic Classification Using Affinity-Propagation-Based Clustering Method

Information Entropy Based Clustering Method for Unsupervised Internet Traffic Classification

A Novel Semi-Supervised Approach for Network Traffic Clustering

Traffic classification using an improved clustering algorithm

Internet Traffic Clustering with Constraints

Internet Traffic Identification Using Community Detecting Algorithm

A Statistical-Feature-based Approach to Internet Traffic Classification Using Machine Learning.

Traffic Classification - Towards Accurate Real Time Network Applications

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

Network Traffic Classification Algorithm Based on Spectral Clustering

Internet Traffic Classification Method Based on Selective Clustering Ensemble of Mutual Information

A Heuristic-Based Co-clustering Algorithm for the Internet Traffic Classification

A Semi-Supervised Clustering Method for Network Application Flow Classification

Towards Automatic Identification of Network Applications

Study on Internet Traffic Classification Using Machine Learning

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

A Semi-Supervised Clustering Algorithm for Real Network Traffic with Concept Drift

Robust network traffic identification with unknown applications.

Network Traffic Classification Using Tri-training Based on Statistical Flow Characteristics

Traffic Classification Using Probabilistic Neural Networks.

Semi-supervised Internet Network Traffic Classification Using a Gaussian Mixture Model