Network Traffic Classification Using Correlation Information

Abstract

Traffic classification has wide applications in network management, from security monitoring to quality of service measurements. Recent research tends to apply machine learning techniques to flow statistical feature based classification methods. The nearest neighbor (NN)-based method has exhibited superior classification performance. It also has several important advantages, such as no requirements of training procedure, no risk of overfitting of parameters, and naturally being able to handle a huge number of classes. However, the performance of NN classifier can be severely affected if the size of training data is small. In this paper, we propose a novel nonparametric approach for traffic classification, which can improve the classification performance effectively by incorporating correlated information into the classification process. We analyze the new classification approach and its performance benefit from both theoretical and empirical perspectives. A large number of experiments are carried out on two real-world traffic data sets to validate the proposed approach. The results show the traffic classification performance can be improved significantly even under the extreme difficult circumstance of very few training samples.

Botnet detection using graph-based feature clustering

“…The effectiveness of this scheme is validated via simulation. Flow correlation information is utilized by Zhang et al [10][11][12] to further improve the classification accuracy considering only a small number of training instances based on K-Nearest-Neighbor and Naive Bayes classifiers that are used to detect anomalies in the network. Yan et al [13] propose a framework of security and trust for 5G based on the perspective that the next generation network functions will be highly virtualized and software defined networking is applied for traffic control.…”

Dynamic Core VNT Adaptability Based on Predictive Metro-Flow Traffic Models

“…As soon as the empirical mean and variance are available for both edges of a segment, the linear equations (intercept and slope) of that segment for both μ and σ 2 models are computed (lines [12][13][14][15][16][17]. Segments are identified by an intercept a that equals the empirical value at the starting of the segment and a slope b computed from the values at both edges and the segment length according to equation (3).…”

“…Let us consider now a particular core OD pair od and its set of aggregated metro-flows F(od), where predictive models for the mean (μf) and the variance (σ Correlation is commonly observed in the traffic and has been already studied in the literature [16]. Therefore, it would not be realistic to assume that the aggregated metro-flows have uncorrelated traffic if, for instance, they convey similar service traffic.…”

О Методах Идентификации Сетевых Трафиков

“…Эта проблему очень трудно решить, если нет информации о реальных приложениях. Для решения этой проблемы в работе [27] предложен новый непараметрический подход, который заключается во включении корреляционной информации потоков в процесс классификации.…”