Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Open accessAbstract
This paper presents a novel traffic classification scheme to improve classification performance when few training data are available. In the proposed scheme, traffic flows are described using the discretized statistical features and flow correlation information is modeled by bag-of-flow (BoF). We solve the BoF-based traffic classification in a classifier combination framework and theoretically analyze the performance benefit. Furthermore, a new BoF-based traffic classification method is proposed to aggregate the naive Bayes (NB) predictions of the correlated flows. We also present an analysis on prediction error sensitivity of the aggregation strategies. Finally, a large number of experiments are carried out on two large-scale real-world traffic datasets to evaluate the proposed scheme. The experimental results show that the proposed scheme can achieve much better classification performance than existing state-of-the-art traffic classification methods.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The F-measure of BoF-NB with the sum rule is over 15% and 10% higher than NB for DNS and POP3, respectively.
“For example, the F-measure of BoF-NB with the sum rule is over 15 and 10% higher than NB for DNS and POP3, respectively.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [496]
Accuracy increases and error sensitivity decreases as the size of BoFs increases, due to growth in BoF intra-diversity.
“Evidently, the accuracy increases and error sensitivity decreases as the size of BoFs increase, due to the growth in BoF intra-diversity [496].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [496]
The F-measure of BoF-NB outperforms NB irrespective of the aggregation rule.
“The F-measure, used to evaluate per class performance, of BoF-NB outperforms NB irrespective of the aggregation rule.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [496]
Cites
Breiman, L. (1996) · Machine Learning · doi:10.1007/bf00058655 · Cited by 16,325 · see citing works
Kittler, J., Hatef, M., Duin, R. P. W., & Matas, J. (1998) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/34.667881 · Cited by 5,312 · see citing works
Chiang, L. H., Russell, E. L., & Braatz, R. D. (2001) · Advanced textbooks in control and signal processing · doi:10.1007/978-1-4471-0347-9_3 · Cited by 5,053 · see citing works
(2000) · Applied Physics Letters · doi:10.1162/153244303322753616 · Cited by 3,581 · see citing works
Multi-Interval Discretization of Continuous-Valued Attributes for Classification Learning
Fayyad, U. M., & Irani, K. B. (1993) · International Joint Conference on Artificial Intelligence · Cited by 2,870 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Statistical Pattern Recognition
Webb, A. R. (2002) · Wiley eBooks · doi:10.1002/0470854774 · Cited by 1,460 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Tao, D., Tang, X., Li, X., & Wu, X. (2006) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2006.134 · Cited by 880 · see citing works
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Williams, N., Zander, S., & Armitage, G. J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1163593.1163596 · Cited by 698 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Support Vector Machines for TCP traffic classification
Este, A., Gringoli, F., & Salgarelli, L. (2009) · Computer Networks · doi:10.1016/j.comnet.2009.05.003 · Cited by 270 · see citing works
Bonfiglio, D., Mellia, M., Meo, M., Rossi, D., & Tofanelli, P. (2007) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1282380.1282386 · Cited by 268 · see citing works
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213 · see citing works
Unexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
Early Recognition of Encrypted Applications
Bernaille, L., & Teixeira, R. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-71617-4_17 · Cited by 200 · see citing works
Flexible Deterministic Packet Marking: An IP Traceback System to Find the Real Source of Attacks
Xiang, Y., Zhou, W., & Guo, M. (2008) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2008.132 · Cited by 160 · see citing works
Self-citationInternet traffic classification demystified
Lim, Y.-S., Kim, H.-C., Jeong, J., Kim, C.-K., Kwon, T. T., & Choi, Y. (2010) · Proceedings of the 6th International Conference · doi:10.1145/1921168.1921180 · Cited by 125 · see citing works
Thu, T. N. T., & Armitage, G. J. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322122 · Cited by 123 · see citing works
Challenging statistical classification for operational usage
Pietrzyk, M., Costeux, J., Urvoy-Keller, G., & En-Najjary, T. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644908 · Cited by 57 · see citing works
A novel semi-supervised approach for network traffic clustering
Wang, Y., Xiang, Y., Zhang, J., & Yu, S. (2011) · International Conference on Network and System Security (NSS) · doi:10.1109/icnss.2011.6059997 · Cited by 45 · see citing works
Self-citationAn automatic application signature construction system for unknown traffic
Wang, Y., Xiang, Y., & Yu, S. (2010) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.1603 · Cited by 42 · see citing works
Self-citationAccurate, Fine-Grained Classification of P2P-TV Applications by Simply Counting Packets
Valenti, S., Rossi, D., Meo, M., Mellia, M., & Bermolen, P. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01645-5_10 · Cited by 38 · see citing works
Experience with high-speed automated application-identification for network-management
Canini, M., Li, W., Žádník, M., & Moore, A. W. (2009) · ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) · doi:10.1145/1882486.1882539 · Cited by 32 · see citing works
Mining Unclassified Traffic Using Automatic Clustering Techniques
Finamore, A., Mellia, M., & Meo, M. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-20305-3_13 · Cited by 28 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
- Authors
- Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y.
- Affiliations
- Deakin University (AU)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2013-01
- Volume
- 8
- Issue
- 1
- Pages
- 5-15
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2040403168
- Cited by
- 175
- References
- 35
- Citations by year
- 2026: 5 · 2025: 4 · 2024: 6 · 2023: 15 · 2022: 18 · 2021: 12 · 2020: 25 · 2019: 17 · 2018: 20 · 2017: 15 · 2016: 15 · 2015: 10 · 2014: 9 · 2013: 4
- FWCI
- 7.24
- Type
- journal article
- Language
- en
- Open access
- green
- figshare.com
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- ResearchOnline - JCU (James Cook University) (submittedVersion)
- Figshare (submittedVersion, cc-by)
- Swinburne figshare (Swinburne University of Technology) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Text and Document Classification Technologies
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- internet traffic classification, naive Bayes, forecast aggregation, flow correlation, classifier combination, limited training data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
