Traffic Classification Techniques Research Articles

CoTNeT: Contextual transformer network for encrypted traffic classification

As network infrastructures continue to grow and traffic encryption technologies evolve at a rapid pace, the task of classifying encrypted traffic has become significantly more intricate. These emerging encryption methods render conventional approaches ineffectual in discerning traffic types, consequently posing novel challenges to network security and administration. Evidently, conventional traffic classification techniques are inadequate when it comes to encrypted traffic. Consequently, researchers have turned to machine learning and deep learning models to address this challenge, achieving remarkable results in this domain. Nonetheless, contemporary deep learning models exhibit a propensity to overly depend on self-attention mechanisms while processing 2D feature maps. This mechanism typically focuses only on individual query-key pairs, neglecting the rich contextual information among adjacent keys, thereby limiting their performance in encrypted traffic classification. To address this limitation, our study examines an innovative approach called CoTNet. The CoT module is integrated into the ResNet model to more comprehensively exploit the contextual associations among input keys. This innovation engenders a sturdier and more potent classification model, adept at comprehensively capturing the inherent patterns and correlated information within input features. The suggested method enhances the ResNet model by substituting the conventional 3x3 convolution operations with CoT modules, thereby more effectively harnessing the contextual associations among input keys. In particular, we integrate self-attention mechanisms at various model levels to more thoroughly capture the inherent patterns and correlated information within input features. Experimental results on two real-world datasets show that CoTNet outperforms multiple state-of-the-art methods in the encrypted traffic classification task.

OptiClass : An Optimized Classifier for Application Layer Protocols Using Bit Level Signatures

Network traffic classification has many applications, such as security monitoring, quality of service, traffic engineering, and so on. For the aforementioned applications, Deep Packet Inspection (DPI) is a popularly used technique for traffic classification because it scrutinizes the payload and provides comprehensive information for accurate analysis of network traffic. However, DPI-based methods reduce network performance because they are computationally expensive and hinder end-user privacy as they analyze the payload. To overcome these challenges, bit-level signatures are significantly used to perform network traffic classification. However, most of these methods still need to improve performance as they perform one-by-one signature matching of unknown payloads with application signatures for classification. Moreover, these methods become stagnant with the increase in application signatures. Therefore, to fill this gap, we propose OptiClass , an optimized classifier for application protocols using bit-level signatures. OptiClass performs parallel application signature matching with unknown flows, which results in faster, more accurate, and more efficient network traffic classification. OptiClass achieves twofold performance gains compared to the state-of-the-art methods. First, OptiClass generates bit-level signatures of just 32 bits for all the applications. This keeps OptiClass swift and privacy-preserving. Second, OptiClass uses a novel data structure called BiTSPLITTER for signature matching for fast and accurate classification. We evaluated the performance of OptiClass on three datasets consisting of twenty application protocols. Experimental results report that OptiClass has an average recall, precision, and F1-score of 97.36%, 97.38%, and 97.37%, respectively, and an average classification speed of 9.08 times faster than five closely related state-of-the-art methods.

Unknown Attack Traffic Classification in SCADA Network Using Heuristic Clustering Technique

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

OPTIMIZATION OF ROUTING USING TRAFFIC CLASSIFICATION IN SOFTWARE DEFINED NETWORKING

Efficient routing is an essential task for any network as it directly impacts the network’s performance. In this paper, we have used traffic classification techniques to optimize routing in Software Defined Network (SDN) and provided a cost aware routing framework. Instead of classifying traffic based on a particular parameter, we perform the traffic classification using a hybrid approach that is based on machine learning techniques. Our framework uses supervised machine learning techniques to classify network flow and detect elephant flows which are too heavy in size and require significant bandwidth. As the requirements of each elephant flow vary with the application, we further perform Quality of Service (QoS) based traffic classification, which classifies these elephant flow into QoS classes as per their QoS requirements. For this purpose, we have used semi-supervised machine learning algorithms. Further, we have proposed a routing algorithm that makes use of the Dijkstra algorithm to compute the best possible shortest path based on the QoS requirements of the elephant flow. The proposed method was implemented and tested on Mininet using a POX controller. The simulation results show that our framework successfully classifies elephant flows with an accuracy of 80% and also computes a low-cost path for each elephant flow based on the actual internet data set.

The Application of Deep Learning for Network Traffic Classification

The classification, detection, and analysis of routine network traffic has been a hot topic for businesses and research institutions due to the proliferation of Internet of Things devices and the explosive development of networks. Traditional methods for categorizing network traffic primarily employ common machine learning algorithms e.g., decision trees and plain Bayes algorithms, but as deep learning technology advances, more and more traffic classifications are being successfully applied. This study examines existing deep learning-based network traffic classification techniques and focuses on the categorization of computer network traffic. Firstly, the research background of the topic is introduced, and then the traffic classification based on deep learning is mainly described, which includes traffic classification based on Stacked Autoencoder, traffic classification based on Convolutional Neural Network and traffic classification based on Recurrent Neural Networks. Following investigation, this paper comes to the conclusion that Long Short-Term Memory and Convolutional Neural Network models are the best deep learning models for traffic classification, with three-dimensional Convolutional Neural Network outperforming the others.

ILETC: Incremental learning for encrypted traffic classification using generative replay and exemplar

With the constant updating of applications and the emergence of various encryption technologies, it is important to achieve continuous learning of encrypted traffic. Traditional encrypted traffic classification techniques can only handle a fixed number of traffic classes and require all traffic data to be available at the same time, which consume a huge amount of memory to save the traffic data. In this paper, we propose an incremental learning method for encrypted traffic classification, called ILETC, to achieve continuous learning of encrypted traffic. ILETC can learn new encrypted traffic classes while avoiding forgetting knowledge of old encrypted traffic, with limited memory resources. It uses WGAN-GP to model the data distribution of encrypted traffic and design an exemplar set to select and store representative real traffic data. When learning from a new class of encrypted traffic, ILETC replays the knowledge of the old classes with the generated samples and exemplars to mitigate catastrophic forgetting. The ISCX VPN-nonVPN dataset and self-collected dataset are used to test the performance of ILETC. The results show that ILETC is superior to the state-of-the-art methods with an accuracy of over 98% on the ISCX dataset and over 94% in the two datasets together.

A neuro‐evolutionary approach for software defined wireless network traffic classification

AbstractAccurate network traffic classification is an essential and challenging issue for wireless network management and survivability. Existing network traffic classification algorithms, on the other hand, cannot meet the required specifications of real networks' in terms of user privacy control overhead, latency, and above all, classification speed. For wireless network traffic classification, machine learning‐based and hybrid optimization techniques have been deployed. This paper takes a software‐defined wireless network (SDWN) architecture for network traffic classification into account. Because the proposed scheme is perfectly contained within the network controller,the SDWN controller's higher processing capability, global visibility, and programmability can be used to achieve real‐time, adaptive, and precise traffic classification. In this paper, a neuro‐evolutionary approach is proposed in which the feed forward neural network (FFNN) is the base classifier and particle swarm optimization (PSO) is used to train the FFNN to accurately classify traffic while minimizing communication overhead between the controller and the SDWN switches. Simulation experiments were conducted by acquiring real‐world internet datasets to test the efficacy of the proposed scheme. The results and the state‐of‐the‐art comparisons show that the proposed approach has outperformed in terms of accuracy in wireless traffic classification.

A Review of Deep Learning Techniques for Encrypted Traffic Classification

Network traffic classification is significant for task such as Quality of Services (QoS) provisioning, resource usage planning, pricing as well as in the context of security such as in Intrusion detection systems. The field has received considerable attention in the industry as well as research communities where approaches such as Port based, Deep packet Inspection (DPI), and Classical machine learning techniques were thoroughly studied. However, the emergence of new applications and encryption protocols as a result of continuous transformation of Internet has led to the rise of new challenges. Recently, researchers have employed deep learning techniques in the domain of network traffic classification in order to leverage the inherent advantages offered by deep learning models such as the ability to capture complex pattern as well as automatic feature learning. This paper reviews deep learning based encrypted traffic classification techniques, as well as highlights the current research gap in the literature. Index Terms : Traffic classification, Encrypted traffic, Deep learning, Machine learning.

A Deep Learning Based Method for Network Application Classification in Software-Defined IoT

Network Application Classification (NAC) is a vital technology for intrusion detection, Quality-of-Service (QoS)-aware traffic engineering, traffic analysis, and network anomalies. Researchers have focused on designing algorithms using deep learning models based on statistical information to address the challenges of traditional payload and port-based traffic classification techniques. Internet of Things (IoT) and Software Defined Network (SDN) are two popular technologies nowadays and aims to connect devices over the internet and intelligently control networks from a centralized space. IoT aims to connect billions of devices; therefore, classification is essential for efficient processing. SDN is a new networking paradigm, which separates data plane measurement from the control plane. The emergence of deep learning algorithms with SDN provides a scalable traffic classification architecture. Due to the inadequate results of payload and port-based approaches, a statistical technique to classify network traffic into different classes using a Convolution Neural Network (CNN) and a Recurrent Neural Network (RNN) is presented in this paper. This paper provides a classification method for software defined IoT networks. The results show that, contrary to other traffic classification methods, the proposed approach offered a better accuracy rate of over 99 %, which is promising.

Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey

Traffic classification is considered an important research area due to the increasing demand in network users. It not only effectively improve the network service identifications and security issues of the traffic network, but also provide robust accuracy and efficiency in different Internet application behaviors and patterns. Several traffic classification techniques have been proposed and applied successfully in recent years. However, the existing literature lack of comprehensive survey which could provide an overview and analysis towards the recent developments in network traffic classification. To this end, this survey presents a comprehensive investigation on traffic classification techniques by carefully reviewing existing methods from a new perspective. We comprehensively discuss the procedures and datasets for traffic classification. Additionally, traffic criteria are proposed, which could be beneficial to assess the effectiveness of the developed classification algorithm. Then, the traffic classification techniques are discussed in detail. Then, we thoroughly discussed the machine learning (ML) methods for traffic classification. For researcher’s convenience, we present the traffic obfuscation techniques, which could be helpful for designing a better classifier. Finally, key findings and open research challenges for network traffic classification are identified along with recommendations for future research directions. In sum, this survey fills the gap of existing surveys and summarizes the latest research developments in traffic classification.

A Survey of techniques for fine-grained web traffic identification and classification.

After decades of rapid development, the scale and complexity of modern networks have far exceed our expectations. In many conditions, traditional traffic identification methods cannot meet the demand of modern networks. Recently, fine-grained network traffic identification has been proved to be an effective solution for managing network resources. There is a massive increase in the use of fine-grained network traffic identification in the communications industry. In this article, we propose a comprehensive overview of fine-grained network traffic identification. Then, we conduct a detailed literature review on fine-grained network traffic identification from three perspectives: wired network, mobile network, and malware traffic identification. Finally, we also draw the conclusion on the challenges of fine-grained network traffic identification and future research prospects.

Analysis of Various Network Traffic Classification Techniques

There are several interconnected entities present within the networked data for which the generation of inferences is important. For instance, hyperlinks are used to interconnect the web pages, calls are used to link the phone accounts, and references are used to connect the research papers and so on. Almost every existing application includes networks within it. The daily lives of individuals include social networking, making financial transactions, generating networks that show physical systems and so on. The manner in which the nodes present within the system influence each other can be known through this research. On the basis of observed attributed of an object within the system, another attributed is predicted using new model. The various network traffic classification techniques are reviewed in terms of certain parameters.

Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning

An increasing number of Internet application services are relying on encrypted traffic to offer adequate consumer privacy. Anomaly detection in encrypted traffic to circumvent and mitigate cyber security threats is, however, an open and ongoing research challenge due to the limitation of existing traffic classification techniques. Deep learning is emerging as a promising paradigm, allowing reduction in manual determination of feature set to increase classification accuracy. The present work develops a deep learning-based model for detection of anomalies in encrypted network traffic. Three different publicly available datasets including the NSL-KDD, UNSW-NB15, and CIC-IDS-2017 are used to comprehensively analyze encrypted attacks targeting popular protocols. Instead of relying on a single deep learning model, multiple schemes using convolutional (CNN), long short-term memory (LSTM), and recurrent neural networks (RNNs) are investigated. Our results report a hybrid combination of convolutional (CNN) and gated recurrent unit (GRU) models as outperforming others. The hybrid approach benefits from the low-latency feature derivation of the CNN, and an overall improved training dataset fitting. Additionally, the highly effective generalization offered by GRU results in optimal time-domain-related feature extraction, resulting in the CNN and GRU hybrid scheme presenting the best model.

A Comparative Study of Traffic Classification Techniques for Smart City Networks.

Smart city networks involve many applications that impose specific Quality of Service (QoS) requirements, thus representing a challenging scenario for network management. Solutions aiming to guarantee QoS support have not been deployed in large-scale networks. Traffic classification is a mechanism used to manage different aspects, including QoS requirements. However, conventional traffic classification methods, such as the port-based method, are inefficient because of their inability to handle dynamic port allocation and encryption. Traffic classification using machine learning has gained research interest as an alternative method to achieve high performance. In fact, machine learning embeds intelligence into network functions, thus improving network management. In this study, we apply machine learning algorithms to predict network traffic classification. We apply four supervised learning algorithms: support vector machine, random forest, k-nearest neighbors, and decision tree. We also apply a port-based method of traffic classification based on applications’ popular assigned port numbers. Then, we compare the results of this method to those obtained from the machine learning algorithms. The evaluation results indicate that the decision tree algorithm provides the highest average accuracy among the evaluated algorithms, at 99.18%. Moreover, network traffic classification using machine learning provides more accurate results and higher performance than the port-based method.

Traffic Classification and Comparative Analysis with Machine Learning Algorithms in Software Defined Networks

In computer networks, diverse applications generate network traffic with different characteristics. Network traffic classification is significant to manage networks better, improve service quality and ensure security. Software-Defined Networks (SDN) provides flexible and adaptable techniques for traffic classification with its programmable structure. SDN flows naturally exhibit particular characteristics of network applications and protocols. Therefore, it can be said that SDN can present significant opportunities in traffic classification using machine learning. This study proposes a traffic classification approach using machine learning models in SDN. In this study, DNS, Telnet, Ping and Voice traffic flows were created on the SDN using the Distributed Internet Traffic Generator (D-ITG) tool. Twelve-attributes representing these traffic flows (the number of packets transmitted, average transmission time, the number of instantly transmitted packets, etc.) were determined, and over the SDN controller in the physical network, a real-time data set was created by collecting data depending on the attributes. Later, the performance of k Nearest Neighbor (k-NN), Support Vector Machine (SVM), Multi-Layer Perceptron (MLP), Decision Tree (DT) and Naive Bayes (NB) machine learning models were tested for traffic classification on this data set. When the k-NN model was tested on this real-time data set, its classification accuracy was obtained as the maximum with 99.4%. Therefore this model has been determined as a machine learning giving the highest classification performance with the lowest cost flow attributes in traffic classification in SDN.

Network traffic classification for data fusion: A survey

Traffic classification groups similar or related traffic data, which is one main stream technique of data fusion in the field of network management and security. With the rapid growth of network users and the emergence of new networking services, network traffic classification has attracted increasing attention. Many new traffic classification techniques have been developed and widely applied. However, the existing literature lacks a thorough survey to summarize, compare and analyze the recent advances of network traffic classification in order to deliver a holistic perspective. This paper carefully reviews existing network traffic classification methods from a new and comprehensive perspective by classifying them into five categories based on representative classification features, i.e., statistics-based classification, correlation-based classification, behavior-based classification, payload-based classification, and port-based classification. A series of criteria are proposed for the purpose of evaluating the performance of existing traffic classification methods. For each specified category, we analyze and discuss the details, advantages and disadvantages of its existing methods, and also present the traffic features commonly used. Summaries of investigation are offered for providing a holistic and specialized view on the state-of-art. For convenience, we also cover a discussion on the mostly used datasets and the traffic features adopted for traffic classification in the review. At the end, we identify a list of open issues and future directions in this research field.

Comparative Analysis of Machine Learning techniques for Network Traffic Classification

Network traffic classification is the operation of giving appropriate identification to the every traffic flowing through a network. Several methods have been applied in the past to achieve network traffic classification including port-based, payload-based, behavior based and so on. These methods have been found to one limitation or the other. Nowadays, attention is now on Machine Learning(ML) methods that rely on the statistical properties of the traffic flows generated. However, ML methods do not perform well when confronted with large-scale traffic data having large number of features and instances. Feature selection is employed to remove non-relevant and redundant features before passing the data to ML classifiers. In this study, network traffic classification using ML methods is demonstrated from two perspectives: one that involves feature selection and one that does not. A number of performance metrics are considered including runtime, accuracy, recall, precision and F- score. The experimental results indicate that the classification without features has an average accuracy and runtime of 94.14% and 0.52 seconds respectively. On the other hand, the method with feature selection has accuracy of 95.61% and average of 0.25 seconds for the runtime. The improvement obtained reflects the importance of applying only relevant and non-redundant features to the ML methods. Thus it recommended that feature selection be included in the network classification process to guarantee an optimal accuracy result.

Research on Traffic Classification of Auto Machine-learning Base on Meta-QNN

The traditional traffic classification task relies on feature engineering by experts with specialized knowledge. With the advent of representation-learn-based traffic classification techniques, machines learned to extract features from traffic data and classify them. In this paper, we research traffic classification technology based on representational learning and import auto-machine learning technology to solve the problems of network architecture design and parameter tuning. We also design a befitting reward function for the network architecture model. The experimental results on the USTC-TF2016 dataset and USTC-TF2016-PLUS shows that the network architecture generated by auto-machine learning technology has better training performance and classification accuracy than a traditional neural network.

Multi-Level P2P Traffic Classification Using Heuristic and Statistical-Based Techniques: A Hybrid Approach

Peer-to-peer (P2P) applications have been popular among users for more than a decade. They consume a lot of network bandwidth, due to the fact that network administrators face several issues such as congestion, security, managing resources, etc. Hence, its accurate classification will allow them to maintain a Quality of Service for various applications. Conventional classification techniques, i.e., port-based and payload-based techniques alone, have proved ineffective in accurately classifying P2P traffic as they possess significant limitations. As new P2P applications keep emerging and existing applications change their communication patterns, a single classification approach may not be sufficient to classify P2P traffic with high accuracy. Therefore, a multi-level P2P traffic classification technique is proposed in this paper, which utilizes the benefits of both heuristic and statistical-based techniques. By analyzing the behavior of various P2P applications, some heuristic rules have been proposed to classify P2P traffic. The traffic which remains unclassified as P2P undergoes further analysis, where statistical-features of traffic are used with the C4.5 decision tree for P2P classification. The proposed technique classifies P2P traffic with high accuracy (i.e., 98.30%), works with both TCP and UDP traffic, and is not affected even if the traffic is encrypted.

Application layer classification of Internet traffic using ensemble learning models

SummaryAccurate application layer classification of Internet traffic has been a necessary requirement for various regulatory, control, and operational purposes of Internet service provider (ISP). Due to the dynamic and ever evolving nature of Internet applications generating a diverse mixture of Internet traffic, it has been necessary to apply deep packet inspection (DPI) techniques for traffic classification. DPI methods offer accuracy but degrade overall network throughput and thus cause problems in ensuring quality of service (QoS) and maintaining service‐level agreements. Moreover, Internet traffic is mostly end to end encrypted. This in turn limits the applicability of DPI techniques and renders them useless, unless the encryption tunnel is broken by the service provider which would risk violating user privacy. To address these trade‐offs between classification accuracy, performance, and user privacy, we resort to machine learning (ML)‐based algorithms. In this article, we apply three ensemble ML algorithms and report their performance metrics in the application layer classification of Internet traffic.