Artificial Immune System Inspired Algorithm for Flow-Based Internet Traffic Classification

Abstract

Internet traffic classification has been researched extensively in the last 10 years, with a few different algorithms applied to it. Internet traffic classification has also become more relevant because of its potential applications in the business world. Having information about network traffic has many benefits in network design, security, management, and accounting. The classification of network traffic is most easily achieved by Machine Learning algorithms, which can automatically build a model from training data, without much input from humans. Artificial Immune System classification algorithms have been used previously to classify network connections in network security systems [1]. They have proven to be very versatile, as well as having low sensitivity to input parameters. Because of this we are encouraged to explore the value of AIS algorithms to the Internet traffic classification problem. In this research, we propose an AIS-inspired algorithm for flow-based traffic classification, where each network flow is classified into an application class. We measure the algorithm's performance with and without the use of kernel functions, using a publicly available data set. We also compare the algorithm's performance with SVM and Naive Bayes classifiers. The algorithm generalizes well and gives high accuracy even with a small training set when compared to other algorithms, although the training and classification times were higher. The algorithm is also insensitive to the use of kernels, which makes it attractive for embedded and IoT applications.

Multilayer Feedforward Neural Network for Internet Traffic Classification

“…Artificial Immune System (AIS) is proposed and used to classify the malicious packets in Intrusion Detection System [16]. Inspired by this approach, AIS based algorithms are proposed to classify the flow of internet traffic and the performance of the proposed method is evaluated with and without using kernel function [17]. The size of the dataset used is 1000 flows.…”

Combining Renyi Entropy and EWMA to Detect Common Attacks in Network

“…Arti¯cial Immune System (AIS) classi¯cation algorithms are also explored and give high accuracy even with a small training set, but their training and classi¯cation times are too high to be acceptable. 22 In order to accelerate detection speed, Monemi et al 12 propose an online statistical tra±c classi¯er using the C4.5 decision tree that runs on NetFPGA hardware platform. Hong et al 7 propose a tra±c classi¯er using iterative-tuning support vector machine (SVM) which has faster training speed than other previously proposed SVM techniques.…”

“…7,12,16,20,22,32 Roughan et al 20¯r st use the KÀnearest neighbor (KÀNN) machine learning method to deal with the tra±c classi¯cation problem. When dealing with test samples by K-NN method, it is necessary to calculate the similarity between test sample and training sample one by one.…”