SubFlow: Towards practical flow-level traffic classification

Abstract

Many research efforts propose the use of flowlevel features (e.g., packet sizes and inter-arrival times) and machine learning algorithms to solve the traffic classification problem. However, these statistical methods have not made the anticipated impact in the real world. We attribute this to two main reasons: (a) training the classifiers and bootstrapping the system is cumbersome, (b) the resulting classifiers have limited ability to adapt gracefully as the traffic behavior changes. In this paper, we propose an approach that is easy to bootstrap and deploy, as well as robust to changes in the traffic, such as the emergence of new applications. The key novelty of our classifier is that it learns to identify the traffic of each application in isolation, instead of trying to distinguish one application from another. This is a very challenging task that hides many caveats and subtleties. To make this possible, we adapt and use subspace clustering, a powerful technique that has not been used before in this context. Subspace clustering allows the profiling of applications to be more precise by automatically eliminating irrelevant features. We show that our approach exhibits very high accuracy in classifying each application on five traces from different ISPs captured between 2005 and 2011. This new way of looking at application classification could generate powerful and practical solutions in the space of traffic monitoring and network management.

Radio Frequency Traffic Classification Over WLAN

“…Since then many papers have attempted to analyse traffic types and perform coarse (identifying traffic type) and/or fine (also identifying the application used) traffic classification using a variety of techniques: a) Nearest Neighbour: Where a decision is made on a testing point's assignment based on its proximity to neighbouring points in the training data [14], [15]. b) Clustering approaches: k-means [16], Density-based spatial clustering (DB-SCAN) [16], subspace clustering [17]. c) Discriminant analysis: Linear Discriminant Analysis (LDA) [14], Quadratic Discriminant Analysis (QDA) [14], Support Vector Machines [18].…”

Peeking Network States with Clustered Patterns

“…With the increasing use of encryption and the emphasis on privacy, the latter approach using flow statistics with no need for inspecting payloads has been widely studied, with supervised learning with well-known classifiers [12] and semi-supervised learning based on clustering [28,10,4]. While supervised learning is known to yield greater accuracy, supplying labelled data is not a trivial requirement, which made clustering to be spot-lighted.…”

A Survey on Encrypted Traffic Classification

“…They used an extended MOGA in feature selection and cluster count optimization for K-Means, resulting in that the detection rate got an increase of 2% to 5%, while the FPR did not increased significantly. Xie G et.al [26] used subspace clustering to make the new classifier learn to identify each application separately just using its own relevant features instead of distinguishing one application from another using the unified feature sets. The approach showed very high accuracy on five traces from different ISPs, and was adaptable to change.…”