A survey of techniques for internet traffic classification using machine learning

Nguyễn, Thùy; Armitage, Grenville

doi:10.1109/surv.2008.080406

Cited by 1,350 publications

(747 citation statements)

References 48 publications

Supporting

Mentioning

689

Contrasting

Unclassified

Order By: Relevance

“…Makine öğrenme teknikleri sınıflandırma problemlerinde başarılı bir şekilde kullanılmaktadır [9,10,11,12]. Literatürde, saldırı tespit sistemlerinde sıklıkla kullanılan makine öğrenme teknikleri aşağıdaki gibidir.…”

Section: Makine öğRenme Teknikleriyle Saldırı Tespitiunclassified

Makine Öğrenmesi Teknikleriyle Saldırı Tespiti: Karşılaştırmalı Analiz

Kaya¹,

Yıldız²

2014

MUFBED

View full text Add to dashboard Cite

Özetİnternet, günlük hayatımızın vazgeçilmez bir parçasıdır. Artan web uygulamaları ve kullanıcı sayısı, veri güvenliği açısından bazı riskleri de beraberinde getirmiştir. Ağ güvenliği için önemli araçlardan biri olan saldırı tespit sistemleri, güvenli iç ağlara yapılan saldırıları ve beklenmeyen erişim taleplerini tespit etmede başarılı bir şekilde kullanılmaktadır. Günümüzde, pek çok araştırmacı, daha etkin saldırı tespit sistemi gerçekleştirilmesi amacıyla çalışma yapmaktadır. Bu amaçla literatürde farklı makine öğrenme teknikleri ile gerçekleştirilmiş pek çok saldırı tespit sistemi vardır. Yapılan bu çalışmada, saldırı tespit sistemlerinde sıklıkla kullanılan makine öğrenme teknikleri araştırılmış, kullandıkları sınıflandırıcılar, veri setleri ve elde edilen başarılar değerlendirilmiştir. Bu amaçla 2007-2013 yılları arasında SCI, SCI Expanded ve EBSCO indekslerince taranan ulusal ve uluslararası dergilerde yayınlanmış 65 makale incelenmiş, sonuçlar, karşılaştırılmalı bir şekilde sunulmuştur. Böylece, gelecekte yapılacak makine öğrenme teknikleri ile saldırı tespiti çalışmalarına bir bakış açısı kazandırılması amaçlanmıştır. Anahtar kelimeler: STS, Makine öğrenmesi, KDD Cup99 Intrusion Detection with Machine Learning Techniques: Comparative Analysis AbstractThe Internet is an indispensable part of our daily lives. The increasing number of web applications and the user, in terms of data security, has some risks. Intrusion detection systems, secure access to internal networks to detect attacks and unexpected due to the demands of one of the important tools for network security. In order to develop more effective intrusion detection systems a lot of investigative work. However, so many different machine learning techniques in the literature with intrusion-detection system. In this study, the intrusion detection systems are frequently used in machine learning techniques are researched, evaluated, and the resulting achievements classifiers, used by datasets. To this end between the years 2007-2013 65 article examined, the results are presented in a way that the comparative. Thus, the determination of the future machine learning techniques to gain a perspective on the work of the attack.

show abstract

Section: Makine öğRenme Teknikleriyle Saldırı Tespitiunclassified

Makine Öğrenmesi Teknikleriyle Saldırı Tespiti: Karşılaştırmalı Analiz

Kaya¹,

Yıldız²

2014

MUFBED

View full text Add to dashboard Cite

show abstract

“…What makes these two classifiers different from existing classifiers that have been proposed is that we set hard performance guarantees for the classifier to adhere to. While current Internet traffic classifiers that have been proposed can classify traffic with little error, none have provided hard performance guarantees [3]. The two performance guarantees that we focus on are the False Alarm Rate (FAR) and the False Discovery Rate (FDR).…”

Section: Motivationmentioning

confidence: 99%

“…Although numerous traffic classification methodologies have been proposed, none provide strict guarantees on performance, particularly false alarm/discovery rates (a claim validated by Nguyen et al in [3]). Such guarantees are essential if a network operator wishes to employ traffic flow control procedures based on the classification labels.…”

Section: Our Contributionmentioning

confidence: 99%

“…Particular care is provided in discussing how both of the binary classifiers are adapted for our multi-class setting. Previous work with SVM-based Internet traffic classifiers show that they perform comparably to any other classifier used [3] so our approach should perform just as well with the added advantage of having performance guarantees. Also for the Internet traffic classifiers, we discuss the feature selection tool that we used so that only relevant features are sent to the classifiers.…”

Section: Network Operations Management Algorithmsmentioning

confidence: 99%

See 1 more Smart Citation

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

Classifying Internet traffic flows online into applications or broader classes without inspecting the packet payloads or without relying on port numbers has become a necessity for network operators. The operators can use this information to monitor their networks and provide per-class quality of service. There has been a great deal of research done on Internet traffic classification recently and numerous techniques have been proposed. While the current techniques can obtain a high accuracy classifying Internet traffic, providing performance guarantees for particular classes of interest has never been addressed. In this thesis, we provide two novel types of online Internet traffic classifiers that can provide performance guarantees on the false alarm and false discovery rates, respectively. These guarantees can be for an entire class (class-wise) or between two classes (pair-wise). Controlling false alarm rates is well-suited for application prioritization (i.e. prioritizing time-sensitive applications like VoIP over HTTP) whereas controlling false discovery rates is better suited for blocking or rate-limiting a targeted class of traffic (i.e. Peer-to-Peer). The classifier that provides false alarm rate guarantees is based on a Neyman-Pearson classification framework while the classifier that provides false discovery rate guarantees is based on the Learning to Satisfy (LSAT) framework. Both of these classifiers are implemented using a machine learning technique, namely, the 2-nu Support Vector Machine (SVM). Moreover, all previous work done with these two statistical methodologies focused on binary classification only; we extend these statistical methodologies to a multi-class setting. In addition to the regular application classification problem, we also present preliminary work on a binary LSAT classifier that can detect, after the reception of only a handful of packets, whether a flow will be large, as defined by a network operator. This large flow detector can act as a preprocessor for regular application classifiers. By allowing only large flows to pass to the classifier, this allows the classifier to focus on the more resource-intensive flows. We validated our Internet traffic classifiers by testing our approaches using data provided by an ISP.ii Abrégé Identifier l'application (ou autre classe plus générale) qui génère un flux de trafic Internet, sans compter sur le numéro du port ou inspecter la charge des paquets, est devenu une nécessité pour les opérateurs de réseau. Les opérateurs peuvent utiliser cette information pour surveiller leurs réseaux et fournir une qualité de service propreà chaque classe. Il y a eu beaucoup de travaux de recherche portant sur la classification du trafic Internet effectué récemment et de nombreuses techniques ontété proposées. Bien que les techniques actuelles puissent obtenir une grande précision pour classer le trafic Internet, offrir des garanties de performance pour des catégories particulières est un problème encore inexploré.Dans ce mémoire, nous proposons deu...

show abstract

“…To overcome these limitations, a number of researchers apply machine learning techniques to traffic classification [3]. Machine learning techniques extract the statistical features of traffic, such as number of packets, flow duration, packet size or inter-arrival time.…”

Section: Introductionmentioning

confidence: 99%

Out-of-Sequence Traffic Classification Based on Improved Dynamic Time Warping

Yan

Yun

Luo

et al. 2013

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYTraffic classification has recently gained much attention in both academic and industrial research communities. Many machine learning methods have been proposed to tackle this problem and have shown good results. However, when applied to traffic with out-of-sequence packets, the accuracy of existing machine learning approaches decreases dramatically. We observe the main reason is that the out-of-sequence packets change the spatial representation of feature vectors, which means the property of linear mapping relation among features used in machine learning approaches cannot hold any more. To address this problem, this paper proposes an Improved Dynamic Time Warping (IDTW) method, which can align two feature vectors using non-linear alignment. Experimental results on two real traces show that IDTW achieves better classification accuracy in out-of-sequence traffic classification, in comparison to existing machine learning approaches.

show abstract

A survey of techniques for internet traffic classification using machine learning

Cited by 1,350 publications

References 48 publications

Makine Öğrenmesi Teknikleriyle Saldırı Tespiti: Karşılaştırmalı Analiz

Makine Öğrenmesi Teknikleriyle Saldırı Tespiti: Karşılaştırmalı Analiz

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

Out-of-Sequence Traffic Classification Based on Improved Dynamic Time Warping

Contact Info

Product

Resources

About