Internet traffic classification based on flows' statistical properties with machine learning. Issue 3 (13th April 2016)

• Record Type: Journal Article
• Authors: Vlăduţu, Alina; Comăneci, Dragoş; Dobre, Ciprian; Batalla, Jordi Mongay; Mastorakis, George; Mavromoustakis, Constandinos X.
• Is Part Of: International journal of network management. Volume 27:Issue 3(2017)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2016-04-13
• Subjects: Computer networks -- Management -- Periodicals; 004.6
• DOI: 10.1002/nem.1929
• Languages: English
• ISSNs: 1055-7148

Abstract

Summary: Machine learning has recently entered the area of network traffic classification as an alternative to the deep packet inspection technique. It provides both unsupervised and supervised learning algorithms that are capable to put aside similar types of traffic or recognize Internet protocols based on some training, pre‐labeled samples. The current work proposes a new approach in the area of network traffic classification using machine learning. First, we extract the unidirectional and bidirectional flows from a traffic capture. A flow is a collection of packets that share sender and receiver IP address and port. Second, we select relevant statistical properties of these flows and use an unsupervised learning mechanism to group flows into clusters based on the similarities. Eventually, we use this classification as training input for a supervised learning engine that will have to properly determine the class of new, unseen traffic flows. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : Machine learning for traffic classification is an interesting alternative to deep packet inspection techniques. In this direction, we present a method to classify network traffic using machine learning. We are able to automatically extract flows out of a traffic capture and find relevant statistical property, which are further fed into our proposed unsupervised learning mechanisms for classification purposes.The classification is used as training input for a supervised learning engine that determines different classes of new and unseen traffic flows.