A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification

Williams, Nigel; Zander, Sebastian; Armitage, Grenville

doi:10.1145/1163593.1163596

Cited by 586 publications

(319 citation statements)

References 8 publications

Supporting

Mentioning

313

Contrasting

Unclassified

Order By: Relevance

“…In [45], Williams et al compared three different Bayesian algorithms (Naïve Bayes with kernel density estimation, Naïve Bayes with discretization, Bayesian network and Naïve Bayes tree algorithms) with a deterministic machine learning algorithm (C4.5 decision tree). All of these classifiers were implemented from the WEKA toolbox.…”

Section: Probabilistic Machine Learning Methodsmentioning

confidence: 99%

“…The optimal subset of features excludes the redundant features that are not relevant for classification. Williams et al compare these two methods extensively in [45].…”

Section: Feature Selectionmentioning

confidence: 99%

“…In [45], Williams et al examined different feature selection methods. We chose the Correlation-based feature selection [84] (with Best First Forward as its subset search) for our feature selection tool as it performed marginally better than their Consistency-based counterparts in [45].…”

Section: Feature Selectionmentioning

confidence: 99%

“…We chose the Correlation-based feature selection [84] (with Best First Forward as its subset search) for our feature selection tool as it performed marginally better than their Consistency-based counterparts in [45]. Correlation-based feature selection measures the correlation between features and the class labels and eliminates the redundant features that are not correlated in mapping a class label.…”

Section: Feature Selectionmentioning

confidence: 99%

See 3 more Smart Citations

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

Classifying Internet traffic flows online into applications or broader classes without inspecting the packet payloads or without relying on port numbers has become a necessity for network operators. The operators can use this information to monitor their networks and provide per-class quality of service. There has been a great deal of research done on Internet traffic classification recently and numerous techniques have been proposed. While the current techniques can obtain a high accuracy classifying Internet traffic, providing performance guarantees for particular classes of interest has never been addressed. In this thesis, we provide two novel types of online Internet traffic classifiers that can provide performance guarantees on the false alarm and false discovery rates, respectively. These guarantees can be for an entire class (class-wise) or between two classes (pair-wise). Controlling false alarm rates is well-suited for application prioritization (i.e. prioritizing time-sensitive applications like VoIP over HTTP) whereas controlling false discovery rates is better suited for blocking or rate-limiting a targeted class of traffic (i.e. Peer-to-Peer). The classifier that provides false alarm rate guarantees is based on a Neyman-Pearson classification framework while the classifier that provides false discovery rate guarantees is based on the Learning to Satisfy (LSAT) framework. Both of these classifiers are implemented using a machine learning technique, namely, the 2-nu Support Vector Machine (SVM). Moreover, all previous work done with these two statistical methodologies focused on binary classification only; we extend these statistical methodologies to a multi-class setting. In addition to the regular application classification problem, we also present preliminary work on a binary LSAT classifier that can detect, after the reception of only a handful of packets, whether a flow will be large, as defined by a network operator. This large flow detector can act as a preprocessor for regular application classifiers. By allowing only large flows to pass to the classifier, this allows the classifier to focus on the more resource-intensive flows. We validated our Internet traffic classifiers by testing our approaches using data provided by an ISP.ii Abrégé Identifier l'application (ou autre classe plus générale) qui génère un flux de trafic Internet, sans compter sur le numéro du port ou inspecter la charge des paquets, est devenu une nécessité pour les opérateurs de réseau. Les opérateurs peuvent utiliser cette information pour surveiller leurs réseaux et fournir une qualité de service propreà chaque classe. Il y a eu beaucoup de travaux de recherche portant sur la classification du trafic Internet effectué récemment et de nombreuses techniques ontété proposées. Bien que les techniques actuelles puissent obtenir une grande précision pour classer le trafic Internet, offrir des garanties de performance pour des catégories particulières est un problème encore inexploré.Dans ce mémoire, nous proposons deu...

show abstract

Section: Probabilistic Machine Learning Methodsmentioning

confidence: 99%

“…The optimal subset of features excludes the redundant features that are not relevant for classification. Williams et al compare these two methods extensively in [45].…”

Section: Feature Selectionmentioning

confidence: 99%

Section: Feature Selectionmentioning

confidence: 99%

Section: Feature Selectionmentioning

confidence: 99%

See 2 more Smart Citations

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

show abstract

“…Previous research showed that for classification of network traffic the better ML techniques provide similar accuracy, but differ greatly regarding training time and classification speed [15]. We used the C4.5 decision tree classifier [16] -more precisely its implementation in the Waikato Environment for Knowledge Analysis (WEKA) [17], because it had performed well previously [15].…”

Section: Machine Learningmentioning

confidence: 99%

Stealthier Inter-packet Timing Covert Channels

2011

Self Cite

View full text Add to dashboard Cite

Abstract. Covert channels aim to hide the existence of communication. Recently proposed packet-timing channels encode covert data in inter-packet times, based on models of inter-packet times of normal traffic. These channels are detectable if normal inter-packet times are not independent identically-distributed, which we demonstrate is the case for several network applications. We show that~80% of channels are detected with a false positive rate of 0.5%. We then propose an improved channel that is much harder to detect. Only~9% of our new channels are detected at a false positive rate of 0.5%. Our new channel uses packet content for synchronisation and works with UDP and TCP traffic. The channel capacity reaches over hundred bits per second depending on overt traffic and network jitter.

show abstract