Performance Analysis of Unsupervised Machine Learning Techniques for Network Traffic Classification

Singh, Hardeep

doi:10.1109/acct.2015.54

Cited by 39 publications

(22 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Classical studies involve rule-based or statistical correlation-based network traffic classification. Machine learning has been researched extensively and studies on network traffic classification using machine learning have been actively conducted [18,19,[21][22][23][24][25][26][27][28][29].…”

Section: Related Workmentioning

confidence: 99%

“…As a result, the C4.5 decision tree algorithm showed better performance than the other two algorithms. Singh et al [18] used an unsupervised machine learning approach for network traffic classification. In this paper, the unsupervised K-means and the expectation maximization algorithm were used to cluster the network traffic application based on the similarity between them.…”

Section: Related Workmentioning

confidence: 99%

“…The study in the field of machine learning have progressed actively, and machine learning has been adopted in various areas [2]. Thus, network traffic classification using machine learning has been researched extensively [17][18][19][20][21][22][23][24][25][26][27][28][29]. Additionally, network traffic classification methods using machine learning in software defined networks (SDNs) are actively researched [21][22][23][24][25][26][27][28][29].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Payload-Based Traffic Classification Using Multi-Layer LSTM in Software Defined Networks

Lim

Kim

et al. 2019

Applied Sciences

View full text Add to dashboard Cite

Recently, with the advent of various Internet of Things (IoT) applications, a massive amount of network traffic is being generated. A network operator must provide different quality of service, according to the service provided by each application. Toward this end, many studies have investigated how to classify various types of application network traffic accurately. Especially, since many applications use temporary or dynamic IP or Port numbers in the IoT environment, only payload-based network traffic classification technology is more suitable than the classification using the packet header information as well as payload. Furthermore, to automatically respond to various applications, it is necessary to classify traffic using deep learning without the network operator intervention. In this study, we propose a traffic classification scheme using a deep learning model in software defined networks. We generate flow-based payload datasets through our own network traffic pre-processing, and train two deep learning models: 1) the multi-layer long short-term memory (LSTM) model and 2) the combination of convolutional neural network and single-layer LSTM models, to perform network traffic classification. We also execute a model tuning procedure to find the optimal hyper-parameters of the two deep learning models. Lastly, we analyze the network traffic classification performance on the basis of the F1-score for the two deep learning models, and show the superiority of the multi-layer LSTM model for network packet classification.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Payload-Based Traffic Classification Using Multi-Layer LSTM in Software Defined Networks

Lim

Kim

et al. 2019

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…K-Means is also used in [16] for P2P traffic identification. Several comparisons among unsupervised algorithm applied to encrypted traffic classification can be found also in [6,40].…”

Section: Related Workmentioning

confidence: 99%

Identification of adaptive video streams based on traffic correlation

Biernacki

2019

Multimed Tools Appl

View full text Add to dashboard Cite

Due to the popularity of Dynamic Adaptive Streaming Over HTTP (DASH), broadband and Internet service providers' links transmit mainly multimedia content. As the most popular providers encrypt their video services, the attempts to identify their traffic through Deep Packet Inspection (DPI) encounter difficulties. Therefore, encrypted DASH traffic requires new classification methods. In this work, we propose to identify DASH traffic taking into account statistical dependencies among video flows. For this purpose, we employ cluster analysis which can identify groups of traffic flows that show similarity using only the application level information. In our work, we applied three unsupervised clustering algorithms, namely MinMax K-Means, OPTICS and AutoClass, to classify video traces obtained from an emulated environment. The experimental results show that the employed algorithms are able to effectively distinguish video flows generated by different play-out strategies. The classification performance depends on the network conditions and parameters of the learning process.

show abstract

“…To overcome these limitations, unsupervised learning methods are proposed to deal with the tra±c classi¯cation problems. 2,4,[24][25][26][27]31 Previous studies have applied some classic clustering algorithms such as K-Means, EM and principal component analysis (PCA) for the task. 4,9,24,25 For example, Wang 25 propose using a PCA method which requires as many as 41 tra±c attributes extracted from network tra±c to cluster abnormal tra±c in UCI KDD network data sets.…”

Section: Introductionmentioning

confidence: 99%

Combining Renyi Entropy and EWMA to Detect Common Attacks in Network

Yan

2016

Int. J. Patt. Recogn. Artif. Intell.

View full text Add to dashboard Cite

How to timely and precisely identify attack behaviors in network without dealing with a large number of tra±c features and historical data, such as training data, is an important research work in the¯eld of network security. In this paper,¯rstly, the di®erences between Renyi entropy and Shannon entropy are analyzed and compared. In order to capture network tra±c changes exactly, Renyi entropy instead of Shannon entropy is proposed to measure selected tra±c features. Then EWMA control chart theory is used to check Renyi entropy time series for detecting and screening anomalies. And three kinds of network attacks are also analyzed and characterized by behavior feature vector for attack identi¯cation. Finally a feature similaritybased method is used to identify attacks. The experimental results of real tra±c traces show that the proposed method has good capability to detect and identify these attacks with less computation cost. To evaluate attack identi¯cation method conveniently, an approach is proposed to generate simulated attack tra±cs. Compared with Shannon entropy-based method, the experiments on simulation tra±cs show that Renyi entropy-based method has much higher overall accuracy, average precision and average true positive rate. Further comparison indicates the proposed method has more powerful performance to detect attacks than PCA-based method.

show abstract

Performance Analysis of Unsupervised Machine Learning Techniques for Network Traffic Classification

Cited by 39 publications

References 6 publications

Payload-Based Traffic Classification Using Multi-Layer LSTM in Software Defined Networks

Payload-Based Traffic Classification Using Multi-Layer LSTM in Software Defined Networks

Identification of adaptive video streams based on traffic correlation

Combining Renyi Entropy and EWMA to Detect Common Attacks in Network

Contact Info

Product

Resources

About