Network Traffic Classification techniques and comparative analysis using Machine Learning algorithms

Shafiq, Muhammad; Yu, Xiangzhan; Laghari, Asif Ali; Lu, Yao; Karn, Nabin Kumar; Abdessamia, Foudil

doi:10.1109/compcomm.2016.7925139

Cited by 131 publications

(72 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The advantage of using a machine learning-based algorithm is that user or application intervention is not required, i.e., users need not select or specify applications classes, and applications require no modification. Since the topic of traffic classification has been well-studied [9], [10] and the classifier itself is not the focus of this paper, we use the same statistic feature as [9] to implement the classifier. In addition, we separate connections by device's IP address and use MAC address to identify the type of devices [11] which is added in the feature.…”

Section: Automatic Traffic Classificationmentioning

confidence: 99%

Virtual Wires: Rethinking WiFi networks

Yang

Jiang

Misra

et al. 2019

2019 IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN)

View full text Add to dashboard Cite

WiFi is the dominant means for home Internet access, yet is frequently a performance bottleneck. Without reliable, satisfactory performance at the last hop, end-to-end quality of service (QoS) efforts will fail. Three major reasons for WiFi bottlenecking performance are its: 1) inherent wireless channel characteristics, 2) approach to access control of the shared broadcast channel, and 3) impact on transport layer protocols, such as TCP, that operate end-to-end, and over-react to the loss or delay caused by the single WiFi link.In this paper, we leverage the philosophy of centralization in modern networking and present our cross layer design to address the problem. Specifically, we introduce centralized control at the point of entry/egress into the WiFi network. Based on network conditions measured from buffer sizes, airtime and throughput, flows are scheduled to the optimal utility. Unlike most existing WiFi QoS approaches, our design only relies on transparent modifications, requiring no changes to the network (including link layer) protocols, applications, or user intervention. Through extensive experimental investigation, we show that our design significantly enhances the reliability and predictability of WiFi performance, providing a "virtual wire"-like link to the targeted application.

show abstract

Section: Automatic Traffic Classificationmentioning

confidence: 99%

Virtual Wires: Rethinking WiFi networks

Yang

Jiang

Misra

et al. 2019

2019 IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN)

View full text Add to dashboard Cite

show abstract

“…Four machine learning methods -c4.5, SVM, Bayes Net and Naï ve Bayes are used for classifying WWW, P3P, FTP, DNS and Telnet applications [1]. The best classifier C4.5's accuracy is above 78% [4].…”

Section: Related Workmentioning

confidence: 99%

“…Supervised learning is commonly used in network traffic classification and it gives good results. Decision trees and random forests are the best classifier for normal applications like WWW, FTP and for encrypted malware classification [4][5] [6]. Ensemble learning algorithms are classifiers formed by a set of base classifiers that cooperate to get an optimal predictive model.…”

Section: Introductionmentioning

confidence: 99%

Ensemble Learning for Detecting Remote Access Trojans

2019

Proceedings of 2019 the 9th International Workshop on Computer Science and Engineering

View full text Add to dashboard Cite

Machine learn ing algorith ms for network traffic classificat ion has been researche d for several years. They are useful for both encrypted and unencrypted network traffic classification. Nowadays malicious malware like Remote Access Trojans go through network, and they are secretly installed in a victim's computer, they stay in the victim host and communicate back to the attacker. The command and control traffic of Remote Access Trojans can be d ifferentiated fro m normal traffic using machine learning based techniques. This paper compares the performance of nine supervised machine learn ing algorithms for detection of Remote Access Trojans. Both unbalanced and balanced dataset are applied for building model. Four ensemble learning methods give high detection rate. Among them, AdaBoost ensemble learning outperforms the competing methods, and it gets the best accuracy, least false negative rate and least false positive rate.

show abstract

“…Advance Machine Learning techniques provide a new dimension for detection of attacks at various levels. The machine learning techniques such as naive bayes, support vector machine (SVM), C4.5 decision trees have been used for the classification of attacks and observed high accuracy factor with C4.5 [34] classifier. The flow based anomaly detection systems adopted a deep learning approach know as deep neural network [35] and observed 75.5% accuracy and has high potential in software defined network (SDN) environment.…”

Section: E Machine Learning Methods For Dpimentioning

confidence: 99%

GDPI: Signature based Deep Packet Inspection using GPUs

Shoaib¹,

Shamsi²,

Mustafa³

et al. 2017

ijacsa

View full text Add to dashboard Cite

Abstract-Deep Packet Inspection (DPI) is necessitated for many networked application systems in order to prevent from cyber threats. The signature based Network Intrusion and Detection System (NIDS) works on packet inspection and pattern matching mechanisms for the detection of malicious content in network traffic. The rapid growth of high speed networks in data centers demand an efficient high speed packet processing mechanism which is also capable of malicious packets detection. In this paper, we proposed a framework GDPI for efficient packet processing which inspects all incoming packet's payload with known signature patterns, commonly available is Snort. The framework is developed using enhanced GPU programming techniques, such as asynchronous packet processing using streams, minimizing CPU to GPU latency using pinned memory and zero copy, and memory coalescing with shared memory which reduces read operation from global memory of the GPU. The overall performance of GDPI is tested on heterogeneous NVIDIA GPUs, like Tegra Tk1, GTX 780, and Tesla K40 and observed that the highest throughput is achieved with Tesla K40. The design code of GDPI is made available for research community.

show abstract

Network Traffic Classification techniques and comparative analysis using Machine Learning algorithms

Cited by 131 publications

References 5 publications

Virtual Wires: Rethinking WiFi networks

Virtual Wires: Rethinking WiFi networks

Ensemble Learning for Detecting Remote Access Trojans

GDPI: Signature based Deep Packet Inspection using GPUs

Contact Info

Product

Resources

About