Multi-classification approaches for classifying mobile app traffic

Abstract

The growing usage of smartphones in everyday life is deeply (and rapidly) changing the nature of traffic traversing home and enterprise networks, and the Internet. Different tools and middleboxes, such as performance enhancement proxies, network monitors and policy enforcement devices, base their functions on the knowledge of the applications generating the traffic. This requirement is tightly coupled to an accurate traffic classification, being exacerbated by the (daily) expanding set of apps and the moving-target nature of mobile traffic. On the top of that, the increasing adoption of encrypted protocols (such as TLS) makes classification even more challenging, defeating established approaches (e.g., Deep Packet Inspection).To this end, in this paper we aim to improve the performance of classification of mobile apps traffic by proposing a multi-classification (viz. fusion) approach, intelligently-combining outputs from state-of-the-art classifiers proposed for mobile and encrypted traffic classification. Under this framework, four classes of different combiners (differing in whether they accept soft or hard classifiers' outputs, the training requirements, and the learning philosophy) are taken into account and compared. The present approach enjoys modularity, as any classifier may be readily plugged-in/out to improve performance further. Finally, based on a dataset of (true) users' activity collected by a mobile solutions provider, our results demonstrate that classification performance can be improved according to all considered metrics, up to +9.5% (recall score) with respect to the best state-of-the-art classifier. The proposed system is also capitalized to validate a novel pre-processing of traffic traces, here developed, and assess performance sensitivity to traffic object (temporal) segmentation, before actual classification.