Research on QoS Classification of Network Encrypted Traffic Behavior Based on Machine Learning

Abstract

In recent years, privacy awareness is concerned due to many Internet services have chosen to use encrypted agreements. In order to improve the quality of service (QoS), the network encrypted traffic behaviors are classified based on machine learning discussed in this paper. However, the traditional traffic classification methods, such as IP/ASN (Autonomous System Number) analysis, Port-based and deep packet inspection, etc., can classify traffic behavior, but cannot effectively handle encrypted traffic. Thus, this paper proposed a hybrid traffic classification (HTC) method based on machine learning and combined with IP/ASN analysis with deep packet inspection. Moreover, the majority voting method was also used to quickly classify different QoS traffic accurately. Experimental results show that the proposed HTC method can effectively classify different encrypted traffic. The classification accuracy can be further improved by 10% with majority voting as K = 13. Especially when the networking data are using the same protocol, the proposed HTC can effectively classify the traffic data with different behaviors with the differentiated services code point (DSCP) mark.

A Hybrid Online Classifier System for Internet Traffic Based on Statistical Machine Learning Approach and Flow Port Number

“…The study [21] proposed a hybrid traffic classification (HTC) method based on machine learning and combined with IP/ASN analysis. The packets with the same IP and port number were treated as same flow.…”

“…The port-based classifier is part of the HOC classification system which is entirely based on a port number. The advantage of port classification is that the identification speed is faster, but the accuracy is poor [21]. In addition, port classification methods are still relevant for certain type of Internet traffic [31] The port classifier of the HOC system checks the flow port number.…”

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

“…Against this backdrop, network traffic classification [1] has become a key research focus in edge intelligent network management. Network traffic classification is the process of categorizing traffic according to different requirements, and is essential in enhancing network security, optimizing network resource management, and improving network service quality [2,3]. Therefore, the effectiveness and accuracy of network traffic classification are crucial for maintaining network service quality and detecting the early signs of potential abnormal network activities, making it a highly significant topic.…”

Elastic aggregation of network flows based on date field clustering

“…In literature [2], under the framework of Software Defined Network (Software Defined Network) (SDN), the number of flow rules is reduced and network flows are aggregated through key based mechanism based on IP address and other information. According to the application type, Huang [3] classified and aggregated the network traffic, obtained the application type keyword by using the Deep Packet Inspection (DPI) detection method, and then aggregated the service traffic according to the pattern matching method. Mookherji uses Support Vector Machines (SVM) technology to select packet length and packet direction as characteristic values to aggregate heterogeneous network traffic [4] .…”