Review of Machine Learning Techniques for Network Traffic Classification

Abstract

Network traffic classification is an essential tool in cyber security for the recognition and interception of cyber insider threats. Traffic classification is the first step to distinguish various applications and protocols that are available in the network. The core component of network intrusion detection is a network traffic analysis that investigates the network behavior based on traffic characterization. Network traffic classification is the centre segment of the network traffic analysis and particularly for filtering traffic in order to identify any malicious activities within the network. Numerous techniques are proposed by researchers to date varying from traditional Port-based to Machine/Deep Learning techniques. Machine Learning emerges as a prominent solution for encrypted and real-time traffic classification; exploiting the statistical properties of the network flow. In this paper various Machine/Deep Learning techniques for network traffic classification are critically evaluated. The main purpose is to investigate different traffic classification approaches (supervised, semi-supervised, unsupervised) and provide summarization for a set of trends followed by various researchers for classifying network traffic.