Internet Traffic Classification Research Articles

Internet Traffic Classification with Federated Learning

As Internet traffic classification is a typical problem for ISPs or mobile carriers, there have been a lot of studies based on statistical packet header information, deep packet inspection, or machine learning. Due to recent advances in end-to-end encryption and dynamic port policies, machine or deep learning has been an essential key to improve the accuracy of packet classification. In addition, ISPs or mobile carriers should carefully deal with the privacy issue while collecting user packets for accounting or security. The recent development of distributed machine learning, called federated learning, collaboratively carries out machine learning jobs on the clients without uploading data to a central server. Although federated learning provides an on-device learning framework towards user privacy protection, its feasibility and performance of Internet traffic classification have not been fully examined. In this paper, we propose a federated-learning traffic classification protocol (FLIC), which can achieve an accuracy comparable to centralized deep learning for Internet application identification without privacy leakage. FLIC can classify new applications on-the-fly when a participant joins in learning with a new application, which has not been done in previous works. By implementing the prototype of FLIC clients and a server with TensorFlow, the clients gather packets, perform the on-device training job and exchange the training results with the FLIC server. In addition, we demonstrate that federated learning-based packet classification achieves an accuracy of 88% under non-independent and identically distributed (non-IID) traffic across clients. When a new application that can be classified dynamically as a client participates in learning was added, an accuracy of 92% was achieved.

Data representation for CNN based internet traffic classification: a comparative study

It has been well established that the Internet of Things will bring an expansion in traffic volume and types. This will bring new challenges in terms of Quality of Service (QoS) and security, requiring innovative traffic management techniques. Traffic classification is a main network function that helps in managing both QoS and security. Different machine learning based methods have been applied for this aim. However, traditional machine learning methods rely on hand crafted features, limiting the model ability to learn. Deep Learning (DL), a branch of machine learning, is characterized by its representation learning ability. In this paper, we analyse two methods of data representation for DL-based classification: a raw packet-based representation and a quasi-raw flow-based representation. Different tests are performed to evaluate the robustness of these data representation methods. The tests include features’ importance, model robustness, and anonymization tests. The results show that raw data representation suffers from traffic anonymization and the fact that many packet fields are data-dependent. On the other hand, the flow-based representation is sensitive to the number of packets used for classification and to traffic obfuscation.

A review on machine learning–based approaches for Internet traffic classification

Traffic classification acquired the interest of the Internet community early on. Different approaches have been proposed to classify Internet traffic to manage both security and Quality of Service (QoS). However, traditional classification approaches consisting of modifying the Transmission Control Protocol/Internet Protocol (TCP/IP) scheme have not been adopted due to their complex management. In addition, port-based methods and deep packet inspection have limitations in dealing with new traffic characteristics (e.g., dynamic port allocation, tunneling, encryption). Conversely, machine learning (ML) solutions effectively classify traffic down to the device type and specific user action. Another research direction aims to anonymize Internet traffic and thwart classification to maintain user privacy. Existing traffic surveys focus on classification and do not consider anonymization. Here, we review the Internet traffic classification and obfuscation techniques, largely considering the ML-based solutions. In addition, this paper presents a comprehensive review of various data representation methods, and the different objectives of Internet traffic classification. Finally, we present the key findings, limitations, and recommendations for future research.

Data mining and machine learning methods for sustainable smart cities traffic classification: A survey

This survey paper describes the significant literature survey of Sustainable Smart Cities (SSC), Machine Learning (ML), Data Mining (DM), datasets, feature extraction and selection for network traffic classification. Considering relevance and most cited methods and datasets of features were identified, read and summarized. As data and data features are essential in Internet traffic classification using machine learning techniques, some well-known and most used datasets with details statistical features are described. Different classification techniques for SSC network traffic classification are presented with more information. The complexity of data set, features extraction and machine learning methods are addressed. In the end, challenges and recommendations for SSC network traffic classification with the dataset of features are presented.

A framework to classify heterogeneous Internet traffic with Machine Learning and Deep Learning techniques for satellite communications

Nowadays, the Internet network system serves as a platform for communication, transaction, and entertainment, among others. This communication system is characterized by terrestrial and Satellite components that interact between themselves to provide transmission paths of information between endpoints. Particularly, Satellite Communication providers’ interest is to improve customer satisfaction by optimally exploiting on demand available resources and offering Quality of Service (QoS). Improving the QoS implies to reduce errors linked to information loss and delays of Internet packets in Satellite Communications. In this sense, according to Internet traffic (Streaming, VoIP, Browsing, etc.) and those error conditions, the Internet flows can be classified into different sensitive and non-sensitive classes. Following this idea, this work aims at finding new Internet traffic classification approaches to improving the QoS. Machine Learning (ML) and Deep Learning (DL) techniques will be studied and deployed to classify Internet traffic. All the necessary elements to couple an ML or DL solution over a well-known Satellite Communication and QoS management architecture will be evaluated. To develop this solution, a rich and complete set of Internet traffic is required. In this context, an emulated Satellite Communication platform will serve as a data generation environment in which different Internet communications will be launched and captured. The proposed classification system will deal with different Internet communications (encrypted, unencrypted, and tunneled). This system will process the incoming traffic hierarchically to achieve a high classification performance. Finally, some experiments on a cloud emulated platform validates our proposal and set guidelines for its deployment over a Satellite architecture.

Edge Computing Intelligence Using Robust Feature Selection for Network Traffic Classification in Internet-of-Things

Internet-of-Things (IoT) devices are massively interconnected, which generates a massive amount of network traffic. The concept of edge computing brings a new paradigm to monitor and manage network traffic at the network’s edge. Network traffic classification is a critical task to monitor and identify Internet traffic. Recent traffic classification works suggested using statistical flow features to classify network traffic accurately using machine learning techniques. The selected classification features must be stable and can work across different spatial and temporal heterogeneity. This paper proposes a feature selection mechanism called Ensemble Weight Approach (EWA) for selecting significant features for Internet traffic classification based on multi-criterion ranking and selection mechanisms. Extensive simulations have been conducted using publicly-available traces from the University of Cambridge. The simulation results demonstrate that EWA is capable of identifying stable features subset for Internet traffic identification. EWA-selected features improve the mean accuracy up to 1.3% and reduce RMSE using fewer features than other feature selection methods. The smaller number of features directly contributes to shorter classification time. Furthermore, the selected features can train stable traffic classification generative models irrespective of the dataset’s spatial and temporal differences, with consistent accuracy up to 97%. The overall performance indicates that EWA-selected statistical flow features can improve the overall traffic classification.

Bit vector-coded simple CART structure for low latency traffic classification on FPGAs

Traffic classification is the determination of the application types during real-time flow of internet traffic. Machine learning (ML) based classification approaches that can classify internet traffic using statistical properties of flows are of great interest, due to its ability to work under encrypted traffic conditions.In this paper, we propose a novel data structure, named Bit Vector Coded Simple CART (BC-SC), for ML based internet traffic classification. BC-SC data structure is a scalable solution in terms of the number of application classes while providing a significant improvement in search latency, memory requirement and throughput when compared to the state-of-the-art approaches. We also designed two alternative hardware architectures, namely Pipelined and Discrete Parallel Range Comparators (DPRC)-based, on the Field Programmable Gate Array (FPGA) platform to support BC-SC data structure. Pipelined and DPRC-based architectures can achieve up to 665 and 914 giga bit per second (Gbps) or 2078 and 2857 million classifications per second (MCPS) respectively for the minimum packet size of 40 Byte. Furthermore, the proposed engines both can reach 96.8125% accuracy with eight application classes.

Online P2P Internet Traffic Classification and Mitigation Based on Snort and ML

Peer to peer applications have modified the nature of internet traffic. It will consume high internet bandwidth and affect the performance of traditional traffic internet applications. Therefore, the management and monitoring activity of internet traffic is the important activities involved in the optimization. In order to detect and mitigate the P2P traffic, port, payload, and transport layer based methods were developed in the past. Nevertheless, the performances of these methods were not up to the expectation. Machine Learning (ML) is one of the promising methods to identify and mitigate the traffic of the Internet. However, the classification accuracy is inconsistent. The reason for the inconsistency is the relevant training datasets generation and feature selection. In this research, a technique based on signature-based and ML is proposed to develop a model for online P2P traffic detection and mitigation. The proposed work can be employed to evaluate the robustness of the online P2P machine learning classifier based on real network traffic traces containing flows labelled by SNORT tool and from special shared resources. Analysis and validation were carried out on traffic traces of University Technology Malaysia. The period of traffic was 2011 and 2013. The output of research is revealing that the proposed work has spent less computation time for classification. This method gives 99.7% accuracy which equals the classification performance attained for P2P using deep packet inspector. The findings show that classifying network traffic at the flow level can differentiate P2P over non-P2P (nP2P) with high confidence for online P2P mitigation.

Online P2P Internet Traffic Classification and Mitigation Based on Snort and ML

Peer to peer applications have modified the nature of internet traffic. It will consume high internet bandwidth and affect the performance of traditional traffic internet applications. Therefore, the management and monitoring activity of internet traffic is the important activities involved in the optimization. In order to detect and mitigate the P2P traffic, port, payload, and transport layer based methods were developed in the past. Nevertheless, the performances of these methods were not up to the expectation. Machine Learning (ML) is one of the promising methods to identify and mitigate the traffic of the Internet. However, the classification accuracy is inconsistent. The reason for the inconsistency is the relevant training datasets generation and feature selection. In this research, a technique based on signature-based and ML is proposed to develop a model for online P2P traffic detection and mitigation. The proposed work can be employed to evaluate the robustness of the online P2P machine learning classifier based on real network traffic traces containing flows labelled by SNORT tool and from special shared resources. Analysis and validation were carried out on traffic traces of University Technology Malaysia. The period of traffic was 2011 and 2013. The output of research is revealing that the proposed work has spent less computation time for classification. This method gives 99.7% accuracy which equals the classification performance attained for P2P using deep packet inspector. The findings show that classifying network traffic at the flow level can differentiate P2P over non-P2P (nP2P) with high confidence for online P2P mitigation.

Empirical Comparison of Cross-Validation and Test Data on Internet Traffic Classification Methods

In this paper, we compare two validation methods that are used to estimate the performance of classification algorithms in a non-problem-specific knowledge scenario. One way to measure the performance of a classification algorithm is to determine its prediction error rate. However, this value cannot be calculated but estimated. In this work, we apply and compare two common methods used for estimation namely: test data and cross-validation. Precisely, we analyze and compare the statistical properties of the K-fold cross-validation and test data estimators of the prediction error rates of six classifiers namely; Naïve Bayes, KNN, Random Forest, SVM, J48, and OneR. From the study, the statistical property of repeated cross-validation tends to stabilize the prediction error estimation which in turn reduces the variance of the prediction error estimator when compared with test data. The NIMS dataset collected over a network was employed in the experimental study.

Effect of Feature Selection on Performance of Internet Traffic Classification on NIMS Multi-Class dataset

The challenges faced by networks nowadays can be solved to a great extent by the application of accurate network traffic classification. Internet network traffic classification is responsible for associating network traffic with the application generating them and helps in the area of network monitoring, Quality of Service management, among other. Traditional methods of traffic classification including port-based, payload-load based, host-based, behavior-based exhibit a number of limitations that range from high computational cost to inability to access encrypted packets for the purpose of classification. Machine learning techniques based on statistical properties are now being employed to overcome the limitations of existing techniques. However, the high number of features of flows that serve as input to the learning machine poses a great challenge that requires the application of a pre-processing stage known as feature selection. Too many irrelevant and redundant features affect predictive accuracy and performance of the learning machine. This work analyses experimentally, the effect of a collection of ranking-basedfilter feature selection methods on a multi-class dataset for traffic classification. In the first stage, the proposed Top-N criterionis applied to the feature sets obtained, while in the second stage we generate for each Top-N set of features a new dataset which is applied as input to a set of four machine learning algorithms (classifiers).Experimental results show the viability of our model as a tool for selecting the optimal subset of features which when applied, lead to improvement of accuracy and performance of the traffic classification process.

Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges

While machine learning and artificial intelligence have long been applied in networking research, the bulk of such works has focused on supervised learning. Recently, there has been a rising trend of employing unsupervised machine learning using unstructured raw network data to improve network performance and provide services, such as traffic engineering, anomaly detection, Internet traffic classification, and quality of service optimization. The growing interest in applying unsupervised learning techniques in networking stems from their great success in other fields, such as computer vision, natural language processing, speech recognition, and optimal control (e.g., for developing autonomous self-driving cars). In addition, unsupervised learning can unconstrain us from the need for labeled data and manual handcrafted feature engineering, thereby facilitating flexible, general, and automated methods of machine learning. The focus of this survey paper is to provide an overview of applications of unsupervised learning in the domain of networking. We provide a comprehensive survey highlighting recent advancements in unsupervised learning techniques, and describe their applications in various learning tasks, in the context of networking. We also provide a discussion on future directions and open research issues, while identifying potential pitfalls. While a few survey papers focusing on applications of machine learning in networking have previously been published, a survey of similar scope and breadth is missing in the literature. Through this timely review, we aim to advance the current state of knowledge, by carefully synthesizing insights from previous survey papers, while providing contemporary coverage of the recent advances and innovations.

A survey on application of machine learning for Internet of Things

Internet of Things (IoT) has become an important network paradigm and there are lots of smart devices connected by IoT. IoT systems are producing massive data and thus more and more IoT applications and services are emerging. Machine learning, as an another important area, has obtained a great success in several research fields such as computer vision, computer graphics, natural language processing, speech recognition, decision-making, and intelligent control. It has also been introduced in networking research. Many researches study how to utilize machine learning to solve networking problems, including routing, traffic engineering, resource allocation, and security. Recently, there has been a rising trend of employing machine learning to improve IoT applications and provide IoT services such as traffic engineering, network management, security, Internet traffic classification, and quality of service optimization. This survey paper focuses on providing an overview of the application of machine learning in the domain of IoT. We provide a comprehensive survey highlighting the recent progresses in machine learning techniques for IoT and describe various IoT applications. The application of machine learning for IoT enables users to obtain deep analytics and develop efficient intelligent IoT applications. This paper is different from the previously published survey papers in terms of focus, scope, and breadth; specifically, we have written this paper to emphasize the application of machine learning for IoT and the coverage of most recent advances. This paper has made an attempt to cover the major applications of machine learning for IoT and the relevant techniques, including traffic profiling, IoT device identification, security, edge computing infrastructure, network management and typical IoT applications. We also make a discussion on research challenges and open issues.

Internet Traffic Classification Based on Incremental Support Vector Machines

Machine learning methods have been deployed widely in Internet traffic classification, which identify encrypted traffic and proprietary protocols effectively based on statistical features of traffic flows. Among these methods, support vector machines (SVMs) have attracted increasing attention as it achieves the state of art performance in traffic classification compared with other machine learning methods. However, traditional SVMs-based traffic classifier also has its limitations in real application: high training complexity and computation cost on both memory and CPU, which leads to the frequent and timely updating of traffic classifier being impractical. In this paper, incremental SVMs (ISVM) model is first introduced to reduce the high training cost of memory and CPU, and realize traffic classifier’s high-frequency and quick updates Besides, a modified version of ISVM model with attenuation factor, called AISVM, is further proposed to utilize valuable information in the previous training data sets. The experimental results have proved the effectiveness of ISVM and AISVM models in traffic classification.

Internet multimedia traffic classification from QoS perspective using semi-supervised dictionary learning models

To address the issue of finegrained classification of Internet multimedia traffic from a Quality of Service (QoS) perspective with a suitable granularity, this paper defines a new set of QoS classes and presents a modified K-Singular Value Decomposition (K-SVD) method for multimedia identification. After analyzing several instances of typical Internet multimedia traffic captured in a campus network, this paper defines a new set of QoS classes according to the difference in downstream/upstream rates and proposes a modified K-SVD method that can automatically search for underlying structural patterns in the QoS characteristic space. We define bag-QoS-words as the set of specific QoS local patterns, which can be expressed by core QoS characteristics. After the dictionary is constructed with an excess quantity of bag-QoS-words, Locality Constrained Feature Coding (LCFC) features of QoS classes are extracted. By associating a set of characteristics with a percentage of error, an objective function is formulated. In accordance with the modified K-SVD, Internet multimedia traffic can be classified into a corresponding QoS class with a linear Support Vector Machines (SVM) classifier. Our experimental results demonstrate the feasibility of the proposed classification method.

Internet traffic classification based on expanding vector of flow

To reduce the number of packets used in categorizing flows, we propose a new traffic classification method by investigating the relationships between flows instead of considering them individually. Based on the flow identities, we introduce seven types of relationships for a flow and a further Expanding Vector (EV) by searching relevant flows in a particular time window. The proposed Traffic Classification method based on Expanding Vector (TCEV) does not require an inspection of the detailed flow properties, and thus, it can be conducted with a linear complexity of the flow number. The experiments performed on real-world traffic data verify that our method (1) attains as high a performance as the representative methods, while significantly reducing the number of processed packets; (2) is robust against packet loss and the absence of flow direction; and (3) is capable of reaching higher accuracy in the recognition of TCP mice flows.

Improving K-NN Internet Traffic Classification Using Clustering and Principle Component Analysis

K-Nearest Neighbour (K-NN) is one of the popular classification algorithm, in this research K-NN use to classify internet traffic, the K-NN is appropriate for huge amounts of data and have more accurate classification, K-NN algorithm has a disadvantages in computation process because K-NN algorithm calculate the distance of all existing data in dataset. Clustering is one of the solution to conquer the K-NN weaknesses, clustering process should be done before the K-NN classification process, the clustering process does not need high computing time to conqest the data which have same characteristic, Fuzzy C-Mean is the clustering algorithm used in this research. The Fuzzy C-Mean algorithm no need to determine the first number of clusters to be formed, clusters that form on this algorithm will be formed naturally based datasets be entered. The Fuzzy C-Mean has weakness in clustering results obtained are frequently not same even though the input of dataset was same because the initial dataset that of the Fuzzy C-Mean is less optimal, to optimize the initial datasets needs feature selection algorithm. Feature selection is a method to produce an optimum initial dataset Fuzzy C-Means. Feature selection algorithm in this research is Principal Component Analysis (PCA). PCA can reduce non significant attribute or feature to create optimal dataset and can improve performance for clustering and classification algorithm. The resultsof this research is the combination method of classification, clustering and feature selection of internet traffic dataset was successfully modeled internet traffic classification method that higher accuracy and faster performance.

Optimizing an artificial immune system algorithm in support of flow-Based internet traffic classification

The problem of classifying traffic flows in networks has become more and more important in recent times, and much research has been dedicated to it. In recent years, there has been a lot of interest in classifying traffic flows by application, based on the statistical features of each flow. Information about the applications that are being used on a network is very useful in network design, accounting, management, and security. In our previous work we proposed a classification algorithm for Internet traffic flow classification based on Artificial Immune Systems (AIS). We also applied the algorithm on an available data set, and found that the algorithm performed as well as other algorithms, and was insensitive to input parameters, which makes it valuable for embedded systems. It is also very simple to implement, and generalizes well from small training data sets. In this research, we expanded on the previous research by introducing several optimizations in the training and classification phases of the algorithm. We improved the design of the original algorithm in order to make it more predictable. We also give the asymptotic complexity of the optimized algorithm as well as draw a bound on the generalization error of the algorithm. Lastly, we also experimented with several different distance formulas to improve the classification performance. In this paper we have shown how the changes and optimizations applied to the original algorithm do not functionally change the original algorithm, while making its execution 50–60% faster. We also show that the classification accuracy of the Euclidian distance is superseded by the Manhattan distance for this application, giving 1–2% higher accuracy, making the accuracy of the algorithm comparable to that of a Naïve Bayes classifier in previous research that uses the same data set.

Effective Feature Selection for 5G IM Applications Traffic Classification

Recently, machine learning (ML) algorithms have widely been applied in Internet traffic classification. However, due to the inappropriate features selection, ML-based classifiers are prone to misclassify Internet flows as that traffic occupies majority of traffic flows. To address this problem, a novel feature selection metric named weighted mutual information (WMI) is proposed. We develop a hybrid feature selection algorithm named WMI_ACC, which filters most of the features with WMI metric. It further uses a wrapper method to select features for ML classifiers with accuracy (ACC) metric. We evaluate our approach using five ML classifiers on the two different network environment traces captured. Furthermore, we also apply Wilcoxon pairwise statistical test on the results of our proposed algorithm to find out the robust features from the selected set of features. Experimental results show that our algorithm gives promising results in terms of classification accuracy, recall, and precision. Our proposed algorithm can achieve 99% flow accuracy results, which is very promising.

Lightweight Internet Traffic Classification based on Packet Level Hidden Markov Models

During the last decade, Internet traffic classification finds its importance not only to safeguard the integrity and security of network resources, but also to ensure the quality of service for business critical applications by optimizing existing network resources. But optimization at first place requires correct identification of different traffic flows. In this paper, we have suggested a framework based on Hidden Markov Model, which will use Internet Packet intrinsic statistical characteristics for traffic classification. The packet inspection based on statistical analysis of its different characteristics has helped to reduce overall computational complexity. Generally, the major challenges associated with any internet traffic classifier are: 1) the limitation to accurately identify encrypted traffic when classification is performed using traditional port based techniques; 2) overall computational complexity, and 3) to achieve high accuracy in traffic identification. Our methodology takes advantage of internet packet statistical characteristics in terms of its size and their inter arrival time in order to model different traffic flows. For experimental results, the data set of mostly used internet applications was used. The proposed HMM models best fit the observed traffic with high accuracy. Achieved traffic identification accuracy was 91% for packet size classifier whereas it was 82% for inter packet time based classifier.