A Machine Learning Approach for Efficient Traffic Classification
Abstract
Traffic classification is of fundamental importance to track the evolution of network applications and model their behaviours. Further, classified traffic is required to understand how the Internet is being used, and to effectively control the services that traffic receives. In this paper we present a machine-learning approach that accurately classifies live traffic using C4.5 decision tree. By collecting 12 features at the start of the flows, without inspecting the packet payload, our method can identify live traffic of different types of applications with 99.8% total accuracy. Moreover, accuracy is not our only concern; we also consider the latency and throughput as of high importance.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Li et al.'s approach uniquely trains the ML model for the application class Attack, enabling early detection and classification of anomalous traffic.
“Their approach uniquely trains the ML model for the application class “Attack”, that enables early detection and classification of anomalous traffic.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
Li et al. [270] classify TCP traffic into application classes, including unknown application classes, using a few packets in a flow.
“Similar to [137, 337], Li et al. [270] classify TCP traffic into application classes, including unknown application classes using a few packets in a flow.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
C4.5 DT outperforms C4.5 DT with AdaBoost and NBKE in Li et al.'s evaluations on WEKA.
“They perform their evaluations on WEKA [288], and find C4.5 DT to outperform C4.5 DT with AdaBoost and NBKE.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
The classification accuracy of C4.5 DT with 0.5% randomly selected training flows exceeds 99% for most classes except Attack, which exhibits moderate-high recall.
“The classification accuracy of C4.5 DT with 0.5% randomly selected training flows, exceed 99% for most classes except Attack, which exhibits moderate-high recall.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
Use of port numbers in conjunction with other features results in slightly higher accuracy.
“Furthermore, the use of port numbers in conjunction with other features results in a slightly higher accuracy.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
Attack is a complex application class that shows no temporal stability and whose characteristics dynamically change over time.
“This is because Attack is a complex application class that shows no temporal stability and its characteristics dynamically change over time.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
Use of port numbers leaves the classifier vulnerable to issues in port-based classification.
“However, this leaves the classifier vulnerable to issues in port-based classification.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [270]
Cites
No free lunch theorems for optimization
Wolpert, D. H., & Macready, W. G. (1997) · IEEE Transactions on Evolutionary Computation · doi:10.1109/4235.585893 · Cited by 14,237 · see citing works
Witten, I. H. (2008) · Cited by 9,115 · see citing works
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
The Boosting Approach to Machine Learning: An Overview
Schapire, R. E. (2003) · Lecture notes in statistics · doi:10.1007/978-0-387-21579-2_9 · Cited by 2,060 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Self-citationKaragiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Self-citationTraffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Williams, N., Zander, S., & Armitage, G. J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1163593.1163596 · Cited by 698 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Self-citationRoughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460 · see citing works
Self-citationDiscriminators for use in flow-based classification
Moore, A. W., Zuev, D. V., & Crogan, M. (2013) · Cited by 396 · see citing works
Self-citationTraffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Early Recognition of Encrypted Applications
Bernaille, L., & Teixeira, R. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-71617-4_17 · Cited by 200 · see citing works
Network algorithmics : an interdisciplinary approach to designing fast networked devices
Varghese, G. (2005) · Cited by 149 · see citing works
Thu, T. N. T., & Armitage, G. J. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322122 · Cited by 123 · see citing works
Clustering Documents with Active Learning Using Wikipedia
Huang, A., Milne, D., Frank, E., et al. (2008) · Proceedings · doi:10.1109/icdm.2008.80 · Cited by 109 · see citing works
Architecture of a network monitor
Moore, A. W., Hall, J., Kreibich, C., Harris, E. P., & Pratt, I. (2003) · Cited by 101 · see citing works
Self-citationKaragiannis, T., Papagiannaki, K., Taft, N., & Faloutsos, M. (2007) · Springer eBooks · doi:10.1007/978-3-540-71617-4_19 · Cited by 74 · see citing works
Learn++.MT: A New Approach to Incremental Learning
Muhlbaier, M. D., Topalis, A., & Polikar, R. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-25966-4_5 · Cited by 50 · see citing works
Automatically Extracting Fields from Unknown Network Protocols
Gopalratnam, K., Basu, S., Dunagan, J., et al. (2006) · Cited by 12 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
- Authors
- Li, W., & Moore, A. W.
- Affiliations
- University of Cambridge (GB)
- ORCID
- Venue
- 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems
- Publisher
- IEEE
- Published
- 2007-10
- Pages
- 310-317
- ISSN
- 1526-7539 (ISSN-L)
- OpenAlex
- W2122192957
- Cited by
- 154
- References
- 25
- Citations by year
- 2026: 3 · 2025: 7 · 2024: 5 · 2023: 6 · 2022: 15 · 2021: 6 · 2020: 6 · 2019: 15 · 2018: 9 · 2017: 6 · 2016: 11 · 2015: 10 · 2014: 9 · 2013: 5 · 2012: 12
- FWCI
- 3.90
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Proceedings - International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (publishedVersion)
- Funders
- Engineering and Physical Sciences Research Council (GR/T10510/02)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- network traffic classification, network traffic, C4.5 decision tree, application identification, flow characteristics, packet header features, latency, throughput
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
