Internet Traffic Classification Using Machine Learning

Abstract

Internet traffic identification and classification is vital to the areas of network management and security monitoring, network planning, and QoS provision. Traditional approaches such as port-based and payload-based identification are becoming increasingly difficult with many new applications (e.g. P2P) using dynamic port numbers, masquerading techniques, and encryption to avoid detection. An alternative approach is to classify traffic by exploiting the distinctive characteristics of flow statistics. We present here a traffic classification scheme based on machine learning (ML). The performance impact of the dataset size, feature selection and ML algorithm selection is demonstrated by experiments. The genetic algorithm based feature selection can dramatically reduce the ML learning and modeling time with less decrease or even a bit increase in classification accuracy. The chosen ML algorithms: TAN, C4.5, NBTree, RandomForest and distance weighted KNN, can reach high classification accuracy. Typically, C4.5 and RandomForest are superior to other ML algorithms in computational complexity. Besides, experiments show that the size of data set would impact on the classification performance, and tuning dataset's size could meet the requirements of specific applications.