Challenging statistical classification for operational usage

Abstract

Accurate identification of network traffic according to application type is a key issue for most companies, including ISPs. For example, some companies might want to ban p2p traffic from their network while some ISPs might want to offer additional services based on the application. To classify applications on the fly, most companies rely on deep packet inspection (DPI) solutions. While DPI tools can be accurate, they require constant updates of their signatures database. Recently, several statistical traffic classification methods have been proposed. In this paper, we investigate the use of these methods for an ADSL provider managing many Points of Presence (PoPs). We demonstrate that statistical methods can offer performance similar to the ones of DPI tools when the classifier is trained for a specific site. It can also complement existing DPI techniques to mine traffic that the DPI solution failed to identify. However, we also demonstrate that, even if a statistical classifier is very accurate on one site, the resulting model cannot be applied directly to other locations. We show that this problem stems from the statistical classifier learning site specific information.

Untitled

“…These algorithms are started with a set of random solution called initial population. Each member of this population is called a chromosome [8]. Each chromosome of this problem which consists of the string genes.…”

“…Arrange the all flow level of traffic data and goes from the multiple constraints function. The multiple constraints satisfied the given threshold function for the selection of constraint function [8,9]. The process of seed selection used genetic algorithm.…”

Comparison of User Traffic Characteristics on Mobile-Access versus Fixed-Access Networks

“…Maier et al [27] analyzed traffic data from the access network of a large European DSL operator, in [28] they analyzed traffic generated by mobile devices connecting to the access network via Wi-Fi. Pietrzyk et al [29] compared statistical classification of ADSL traffic to deep packet inspection. Romirer-Maierhofer et al [30] studied round trip times in a 3G network.…”

Classification of content and users in BitTorrent by semi-supervised learning methods

“…According to the Wikipedia article about BitTorrent [2], the traffic generated by BitTorrent is greater than the traffic generated by Netflix and Hulu combined. Recently, a significant research effort has been done to develop tools for automatic classification of Internet traffic by application [9], [8], [11]. The purpose of the present work is to provide a framework for subclassification of P2P traffic generated by the BitTorrent protocol.…”

“…The purpose of the present work is to provide a framework for subclassification of P2P traffic generated by the BitTorrent protocol. Unlike previous works [9], [8], [11], we cannot rely on packet level characteristics (packet size, packet interarrival time, etc). Instead we make use of the bipartite user-content graph.…”