Automated traffic classification and application identification using machine learning
Open accessAbstract
The dynamic classification and identification of network applications responsible for network traffic flows offers substantial benefits to a number of key areas in IP network engineering, management and surveillance. Currently such classifications rely on selected packet header fields (e.g. port numbers) or application layer protocol decoding. These methods have a number of shortfalls e.g. many applications can use unpredictable port numbers and protocol decoding requires a high amount of computing resources or is simply infeasible in case protocols are unknown or encrypted. We propose a novel method for traffic classification and application identification using an unsupervised machine learning technique. Flows are automatically classified based on statistical flow characteristics. We evaluate the efficiency of our approach using data from several traffic traces collected at different locations of the Internet. We use feature selection to find an optimal feature set and determine the influence of different features
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Average packet size is fairly constant in nature.
“Average packet size is fairly constant in nature [492] and packet inter-arrival times are a good discriminator for bulk data transfer (e.g.FTP) and streaming applications [390].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [492]
Packet inter-arrival times and their distributions are affected by queuing in routers.
“However, average packet size can be skewed by intermediate fragmentation and encryption, and packet inter-arrival times and their distributions are affected by queuing in routers [492].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [492]
Cites
Maximum Likelihood from Incomplete Data Via the <i>EM</i> Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444 · see citing works
A Comparative Study on Feature Selection in Text Categorization
Yang, Y., & Pedersen, J. (1997) · Cited by 4,749 · see citing works
Maximum Likelihood from Incomplete Data via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1976) · Cited by 4,517 · see citing works
(1998) · Cited by 3,476 · see citing works
Bayesian classification (AutoClass): theory and results
Cheeseman, P., & Stutz, J. (1996) · Cited by 963 · see citing works
Accurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Hohn, N., & Veitch, D. (2003) · doi:10.1145/948205.948235 · Cited by 158 · see citing works
Traffic Classification Using a Statistical Approach
Zuev, D., & Moore, A. W. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_25 · Cited by 140 · see citing works
Self-Learning IP Traffic Classification Based on Statistical Flow Characteristics
Zander, S., Thu, T. N. T., & Armitage, G. J. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_26 · Cited by 116 · see citing works
Self-citationOn the correlation of Internet flow characteristics
Lan, K.-C., & Heidemann, J. (2003) · Cited by 57 · see citing works
Flow classification by histograms
Soule, A., Salamatia, K., Taft, N., et al. (2004) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1005686.1005696 · Cited by 57 · see citing works
Fernandes, S. (2017) · Springer eBooks · doi:10.1007/978-3-319-54521-9_4 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Self-citationBoutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
Self-citationAhmed, M. T., Rahman, M., Nur, S., Islam, A., & Das, D. (2021) · 2021 International Conference on Advances in Electrical, Computing, Communication and Sustainable Technologies (ICAECT) · doi:10.1109/icaect49130.2021.9392608 · Cited by 60 · see citing works
Internet Traffic Classification Using Machine Learning: A Token-based Approach
Wang, Y., Xiang, Y., & Yu, S. (2011) · 2011 14th IEEE International Conference on Computational Science and Engineering · doi:10.1109/cse.2011.58 · Cited by 15 · see citing works
- Authors
- Zander, S., Nguyen, T., & Armitage, G.
- Affiliations
- Swinburne University of Technology (AU)
- ORCID
- Zander, S.
- Venue
- The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l
- Publisher
- IEEE
- Published
- 2005
- Pages
- 250-257
- ISSN
- 0742-1303 (ISSN-L)
- OpenAlex
- W2149274049
- Cited by
- 517
- References
- 15
- Citations by year
- 2026: 2 · 2025: 6 · 2024: 12 · 2023: 16 · 2022: 17 · 2021: 26 · 2020: 22 · 2019: 36 · 2018: 25 · 2017: 30 · 2016: 29 · 2015: 30 · 2014: 27 · 2013: 30 · 2012: 30
- FWCI
- 16.40
- Type
- conference paper
- Language
- en
- Open access
- green
- figshare.com
- Licence
- cc-by
- Locations
- Conference on Local Computer Networks (publishedVersion)
- Murdoch University Research Portal (submittedVersion)
- Figshare (submittedVersion, cc-by)
- Swinburne figshare (Swinburne University of Technology) (submittedVersion)
- Swinburne figshare (Swinburne University of Technology)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- network traffic classification, application identification, unsupervised learning, feature selection, network flow analysis, encrypted traffic, port numbers
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
