Towards Video Flow Classification at a Million Encrypted Flows Per Second

Abstract

As end-to-end encryption on the Internet is becoming more prevalent, techniques such as deep packet inspection (DPI) can no longer be expected to be able to classify traffic. In many cellular networks a large fraction of all traffic is video traffic, and being able to divide flows in the network into video and non-video can provide considerable traffic engineering benefits. In this study we examine machine learning based flow classification using features that are available also for encrypted flows. Using a data set of several several billion packets from a live cellular network we examine the obtainable classification performance for two different ensemble-based classifiers. Further, we contrast the classification performance of a statistical-based feature set with a less computationally demanding alternate feature set. To also examine the runtime aspects of the problem, we export the trained models and use a tailor-made C implementation to evaluate the runtime performance. The results quantify the trade-off between classification and runtime performance, and show that up to 1 million classifications per second can be achieved for a single core. Considering that only the subset of flows reaching some minimum flow length will need to be classified, the results are promising with regards to deployment also in scenarios with very high flow arrival rates.

A Wearable Machine Learning Solution for Internet Traffic Classification in Satellite Communications

“…Following, the complete framework was implemented in C. The tree-based models are built in scikit-learn 8 and parsed to C for faster Internet classifica-tions, inspired by the work in [4]. These tests were performed on a PC with an i7-6700HQ CPU and 32Gb RAM.…”

The benefits of general-purpose on-NIC memory

“…Crucially, however, packet payloads are completely ignored by most NFs. The waste of copying payloads into hostmem is compounded by the fact that payloads are typically an order of magnitude larger than headers: network traffic characteristics studies show that packet sizes in data centers, universities, and on the Internet follow a bimodal clustering pattern around small ≈ 200 B and large ≈ 1400 B packets [5,16,42,60,108].…”

Timely Classification and Verification of Network Traffic Using Gaussian Mixture Models

“…In our experiments we compared the performance of our GMM-based approach with 6 of the most commonly used supervised machine learning algorithms [56]: Naive-Bayes (NB) [32], [57], [58], Decision Tree (DT) [7], k-Nearest Neighbour (k-NN) [59], Support Vector Machines (SVM) [26], [60], [61], Random Forest (RF) [11], [62], [63], and Gradient Boosted Trees (GBT) [63]. We used scikitlearn 5 to implement all classifiers, except for GBT we used XGBOOST 6 as it is significantly faster.…”