Packet-Sequence and Byte-Distribution is Enough for Real-Time Identification of Application Traffic

Abstract

With the development of Internet technology, application traffic identification based on Machine learning has taken much attention in the past decade. However, there are still some problems even if many traffic classification schemes have been proposed, which will affect the QoS (Quality of Service) of application traffic identification. First, the complete-flow-based methods will fail when facing incomplete flows and multiple flows in real-time detection. Second, the model generalization ability will decrease if using raw traffic data as input directly, especially the representation learning model. For these reasons, in this paper, we developed a new traffic classification method based on packet-sequence and byte-distribution, which can be used for application traffic identification. The byte-distribution of packet-sequence can be obtained through statistics directly without parsing the application protocol. The packet-sequence analysis unit avoids problems caused by the incomplete network flow, which is more suitable for real-time detection. Using packet payload byte-distribution instead of raw data balances the relationship between raw input and manual intervention to a certain extent. In order to prove that packet-sequence and byte-distribution are enough for application traffic classification, we tested our traffic classification method on the dataset we collected in the environment of Ethernet. We achieved an accuracy of 97.485%, which is a good performance. Our method also demonstrated good real-time performance and an acceptable detection result.