Offline/realtime traffic classification using semi-supervised learning
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Erman et al. [137] propose a semi-supervised TCP traffic classification technique that partially overcomes the limitation of a priori knowledge of application class or protocol.
“[137] propose a semi-supervised TCP traffic classification technique that partially overcomes a limitation of [55] and [337]-a priori knowledge of application class or protocol.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
Erman et al.'s classifier remains fairly robust over time for different traces.
“Furthermore, the classifier remains fairly robust over time for different traces.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
A significant increase in the average distance of new flows to their nearest cluster mean indicates a need for retraining, which could be achieved by incremental learning.
“A significant increase in the average distance of new flows to their nearest cluster mean is indicative of the need for retraining, which could be achieved by incremental learning.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
Erman et al.'s approach has a small memory footprint and allows updating the model and potentially improving classification performance.
“This approach not only has a small memory footprint, it allows to update the model and potentially improve classification performance [137].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
In offline classification, Erman et al. [137] achieve over 94% flow accuracy with just two randomly labeled flows per cluster, amongst a mix of 64,000 unlabeled flows and k = 400.
“In offline classification, the authors in [137] achieve over 94% flow accuracy with just two randomly labeled flows per cluster, amongst a mix of 64,000 unlabeled flows and k = 400.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
Erman et al. integrate their layered online classification in Bro and achieve byte accuracies in the 70-90% range.
“The authors integrate their layered online classification in Bro and achieve byte accuracies in the 70-90% range.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
Joint application of supervised and unsupervised ML for traffic classification has demonstrated success.
“Consequentially, joint application of supervised and unsupervised ML for traffic classification [137, 497] has demonstrated success.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [137]
Cites
Seel, N. M. (2012) · Springer eBooks · doi:10.1007/978-1-4419-1428-6_5195 · Cited by 19,525 · see citing works
An introduction to variable and feature selection
GuyonIsabelle, & ElisseeffAndré (2003) · Journal of Machine Learning Research · doi:10.5555/944919.944968 · Cited by 7,843 · see citing works
An Introduction to Variable and Feature Selection.
Guyon, I., & Elisseeff, A. (2003) · Cited by 6,576 · see citing works
Chapelle, O., Schölkopf, B., & Zien, A. (2006) · The MIT Press eBooks · doi:10.7551/mitpress/9780262033589.001.0001 · Cited by 4,560 · see citing works
Abe, S. (2001) · Springer eBooks · doi:10.1007/978-1-4471-0285-4 · Cited by 3,740 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
A probabilistic framework for semi-supervised clustering
Basu, S., Bilenko, M., & Mooney, R. J. (2004) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1014052.1014062 · Cited by 823 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Self-citationTransport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Williams, N., Zander, S., & Armitage, G. J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1163593.1163596 · Cited by 698 · see citing works
Analyzing Peer-To-Peer Traffic Across Large Networks
Sen, S. B., & Wang, J. (2004) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2004.826277 · Cited by 587 · see citing works
Empirically derived analytic models of wide-area TCP connections
Paxson, V. (1994) · IEEE/ACM Transactions on Networking · doi:10.1109/90.330413 · Cited by 581 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
Estan, C., Keys, K., Moore, D., & Varghese, G. (2004) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1015467.1015495 · Cited by 359 · see citing works
Profiling internet backbone traffic
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080112 · Cited by 337 · see citing works
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213 · see citing works
Self-citationUnexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
Semi-supervised learning of mixture models
Cozman, F. G., Cohen, I. L., & Cirelo, M. C. (2003) · Cited by 198 · see citing works
Self-citationIdentifying elephant flows through periodically sampled packets
Mori, T., Uchida, M., Kawahara, R., et al. (2004) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028803 · Cited by 178 · see citing works
On Quantitative Evaluation of Clustering Systems
He, J., Tan, A., Tan, C. L., & Sung, S. Y. (2004) · Network theory and applications · doi:10.1007/978-1-4613-0227-8_4 · Cited by 114 · see citing works
Flow sampling under hard resource constraints
Duffield, N. G., Lund, C., & Thorup, M. (2004) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1005686.1005699 · Cited by 110 · see citing works
Clustering and Information Retrieval
Wu, W., Xiong, H., & Shekhar, S. (2004) · Network theory and applications · doi:10.1007/978-1-4613-0227-8 · Cited by 78 · see citing works
The Power of Slicing in Internet Flow Measurement
Kompella, R. R., & Estan, C. (2005) · Cited by 55 · see citing works
Erman, J., Mahanti, A., & Arlitt, M. F. (2007) · doi:10.1145/1269880.1269890 · Cited by 51 · see citing works
Self-citationSemi-Supervised Learning of Mixture Models and Bayesian Networks
Cozman, F. G., Cohen, I. L., & Cirelo, M. C. (2003) · Cited by 44 · see citing works
Self-citationThe power of slicing in internet flow measurement
Kompella, R. R., & Estan, C. (2005) · doi:10.1145/1330107.1330119 · Cited by 36 · see citing works
Accurate, Scalable In›Network Identication of P2P Trafc Using Application Signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · Cited by 21 · see citing works
Analysis of errors in network load measurements
Belenki, S., & Tafvelin, S. (2000) · ACM SIGCOMM Computer Communication Review · doi:10.1145/505688.505690 · Cited by 12 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2707140 · Cited by 810 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Machine Learning in Software Defined Networks: Data collection and traffic classification
Amaral, P., Dinis, J., Pinto, P., Bernardo, L., Tavares, J., & Mamede, H. S. (2016) · 2016 IEEE 24th International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2016.7785327 · Cited by 172 · see citing works
A Framework for QoS-aware Traffic Classification Using Semi-supervised Machine Learning in SDNs
Wang, P., Lin, S.-C., & Luo, M. (2016) · 2016 IEEE International Conference on Services Computing (SCC) · doi:10.1109/scc.2016.133 · Cited by 155 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
Inferring applications at the network layer using collective traffic statistics
Jin, Y., Duffield, N., Haffner, P., Sen, S., & Zhang, Z.-L. (2010) · 2010 22nd International Teletraffic Congress (lTC 22) · doi:10.1109/itc.2010.5608729 · Cited by 7 · see citing works
- Authors
- Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C.
- Affiliations
- University of Calgary (CA)
- Indian Institute of Technology Delhi (IN)
- Hewlett-Packard (United States) (US)
- Corresponding author
- Mahanti, Anirban
- Venue
- Performance Evaluation
- Publisher
- Elsevier BV
- Published
- 2007-10
- Volume
- 64
- Issue
- 9-12
- Pages
- 1194-1213
- ISSN
- 0166-5316 (ISSN-L)
- OpenAlex
- W2087405576
- Cited by
- 287
- References
- 37
- Citations by year
- 2026: 3 · 2025: 2 · 2024: 5 · 2023: 7 · 2022: 12 · 2021: 15 · 2020: 17 · 2019: 17 · 2018: 16 · 2017: 11 · 2016: 15 · 2015: 27 · 2014: 18 · 2013: 17 · 2012: 25
- FWCI
- 18.54
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- Performance Evaluation (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- network traffic classification, semi-supervised learning, flow-based classification, weighted sampling, classifier retraining, real-time traffic classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
