Internet Traffic Classification Using Machine Learning: A Token-based Approach
Abstract
Due to the increasing unreliability of traditional port-based methods, Internet traffic classification has attracted a lot of research efforts in recent years. Quite a lot of previous papers have focused on using statistical characteristics as discriminators and applying machine learning techniques to classify the traffic flows. In this paper, we propose a novel machine learning based approach where the features are extracted from packet payload instead of flow statistics. Specifically, every flow is represented by a feature vector, in which each item indicates the occurrence of a particular token, i.e., a common substring, in the payload. We have applied various machine learning algorithms to evaluate the idea and used different feature selection schemes to identify the critical tokens. Experimental result based on a real-world traffic data set shows that the approach can achieve high accuracy with low overhead.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Flow feature-based traffic classification exploits the diversity and distinguishable characteristics of the traffic footprint generated by different applications.
“In essence, flow feature-based traffic classification exploits the diversity and distinguishable characteristics of the traffic footprint generated by different applications [31,467].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [467]
Cites
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,493 · see citing works
Witten, I. H. (2008) · Cited by 9,115 · see citing works
Aho, A. V., & Corasick, M. J. (1975) · Communications of the ACM · doi:10.1145/360825.360855 · Cited by 2,973 · see citing works
An extensive empirical study of feature selection metrics for text classification
Forman, G. (2003) · Cited by 2,379 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Karagiannis, T., Broido, A., Brownlee, N., Claffy, K. C., & Faloutsos, M. (2005) · IEEE Global Telecommunications Conference, 2004. GLOBECOM '04. · doi:10.1109/glocom.2004.1378239 · Cited by 504 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Unexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
Color Set Size problem with applications to string matching
Chi, L., & Hui, K. (1992) · Lecture notes in computer science · doi:10.1007/3-540-56024-6_19 · Cited by 168 · see citing works
Semi-supervised network traffic classification
Erman, J., Mahanti, A., Arlitt, M. F., Cohen, I., & Williamson, C. L. (2007) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1254882.1254934 · Cited by 93 · see citing works
Challenging statistical classification for operational usage
Pietrzyk, M., Costeux, J., Urvoy-Keller, G., & En-Najjary, T. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644908 · Cited by 57 · see citing works
Semi-supervised network traffic classification
Erman, J., Mahanti, A., Arlitt, M. F., Cohen, I., & Williamson, C. L. (2007) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1269899.1254934 · Cited by 52 · see citing works
On the Portability of Trained Machine Learning Classifiers for Early Application Identification
Verticale, G. (2008) · International Conference on Emerging Security Information, Systems and Technologies · doi:10.1109/securware.2008.13 · Cited by 2 · see citing works
Flagged first, then by citations
1 of the 24 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Network traffic classification for data fusion: A survey
Zhao, J., Jing, X., Yan, Z., & Witold Pedrycz, C. (2021) · Information Fusion · doi:10.1016/j.inffus.2021.02.009 · Cited by 155 · see citing works
Recent Advancement in Machine Learning Based Internet Traffic Classification
Namdev, N., Agrawal, S., & Silkari, S. (2015) · Procedia Computer Science · doi:10.1016/j.procs.2015.08.238 · Cited by 69 · see citing works
Scalable Architecture for SDN Traffic Classification
Hayes, M., Ng, B., Pekár, A., & Seah, W. K. G. (2017) · IEEE Systems Journal · doi:10.1109/jsyst.2017.2690259 · Cited by 59 · see citing works
Traffic Classification Based on Zero-Length Packets
Kampeas, J., Cohen, A., & Gurewitz, O. (2018) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2018.2825881 · Cited by 30 · see citing works
Internet traffic classification using machine learning approach: Datasets validation issues
Ibrahim, H. A. H., Zuobi, O. R. A. L., Al-Namari, M. A., MohamedAli, G., & Abdalla, A. A. A. (2016) · Conference of Basic Sciences and Engineering Studies (SGCAC) · doi:10.1109/sgcac.2016.7458022 · Cited by 23 · see citing works
A low complexity real-time Internet traffic flows neuro-fuzzy classifier
Rizzi, A., Iacovazzi, A., Baiocchi, A., & Colabrese, S. (2015) · Computer Networks · doi:10.1016/j.comnet.2015.09.011 · Cited by 19 · see citing works
Low complexity, high performance neuro-fuzzy system for Internet traffic flows early classification
Rizzi, A., Colabrese, S., & Baiocchi, A. (2013) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2013.6583538 · Cited by 18 · see citing works
Taxonomy of Machine Learning Algorithms to classify real- time Interactive applications
Awad, H., Ibrahim, H., Nor, S. M., Mohammed, A., Babiker, A., & Malaysia-UTM, T. (2012) · Cited by 11 · see citing works
A Comparative Study of Machine Learning-based Approach for Network Traffic Classification
Trang, K., & Nguyen, H. A. (2021) · Knowledge Engineering and Data Science · doi:10.17977/um018v4i22021p128-137 · Cited by 7 · see citing works
Spatio-temporal beam-level traffic forecasting in 5G wireless systems using multi-task learning
Tommy, I., Akinola, T. A., Li, X., & Qian, L. (2025) · Frontiers in Communications and Networks · doi:10.3389/frcmn.2025.1658461 · Cited by 2 · see citing works
Classification of Cyberattack detection in Network Traffic using Machine learning techniques
Purushotham, P., & Muddana, A. L. (2024) · IEEE International Conference on Interdisciplinary Approaches in Technology and Management for Social Innovation (IATMSI) · doi:10.1109/iatmsi60426.2024.10502442 · Cited by 2 · see citing works
Swamy, M. K., Venkatesh, N., Suhasini, R., Reddy, R. V., Laxmaiah, B., & Sonth, M. V. (2025) · Lecture notes in networks and systems · doi:10.1007/978-3-031-88992-9_46 · Cited by 1 · see citing works
Narayanan, V. A., Sureshkumar, V., & Rajeswari, A. (2014) · Advances in intelligent systems and computing · doi:10.1007/978-81-322-2126-5_34
Machine learning: Enhancing the Perception of the Computer
Logeswari, T. (2020) · International Journal of Engineering and Advanced Technology · doi:10.35940/ijeat.d6486.049420
- Authors
- Wang, Y., Xiang, Y., & Yu, S.
- Affiliations
- Deakin University (AU)
- ORCID
- Venue
- 2011 14th IEEE International Conference on Computational Science and Engineering
- Publisher
- IEEE
- Published
- 2011-08
- Pages
- 285-289
- OpenAlex
- W2160607011
- Cited by
- 15
- References
- 24
- Citations by year
- 2025: 2 · 2024: 1 · 2021: 2 · 2020: 1 · 2018: 2 · 2017: 1 · 2016: 1 · 2015: 2 · 2014: 1 · 2013: 1 · 2012: 1
- FWCI
- 0.75
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Computational Science and Engineering (CSE) (publishedVersion)
- Deakin Research Online (Deakin University) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Text and Document Classification Technologies
- Keywords
- internet traffic classification, feature selection, network traffic flow
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
