Cited by 157Internet Traffic Analysis and Secure E-votingNetwork Security and Intrusion DetectionSoftware-Defined Networks and 5G

Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic

Nguyen, Thuy T. T., Armitage, Grenville, Branch, Philip, Zander, Sebastian·2012·IEEE/ACM Transactions on Networking

Abstract

Machine Learning (ML) for classifying IP traffic has relied on the analysis of statistics of full flows or their first few packets only. However, automated QoS management for interactive traffic flows requires quick and timely classification well before the flows finish. Also, interactive flows are often long-lived and should be continuously monitored during their lifetime. We propose to achieve this by using statistics derived from sub-flows—a small number of most recent packets taken at any point in a flow's lifetime. Then, the ML classifier must be trained on a set of sub-flows, and we investigate different sub-flow selection strategies. We also propose to augment training datasets so that classification accuracy is maintained even when a classifier mixes up client-to-server and server-to-client directions for applications exhibiting asymmetric traffic characteristics. We demonstrate the effectiveness of our approach with the Naive Bayes and C4.5 Decision Tree ML algorithms, for the identification of first-person-shooter online game and VoIP traffic. Our results show that we can classify both applications with up to 99% Precision and 95% Recall within less than 1 s. Stable results are achieved regardless of where within a flow the classifier captures the packets and the traffic direction.

Integrity signals

Registry

Crossref · 10.1109/tnet.2012.2187305

Cites

49 of 49 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

4 of the 53 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S.
Affiliations
Swinburne University of Technology (AU)
Venue
IEEE/ACM Transactions on Networking
Published
2012-12
Volume
20
Issue
6
Pages
1880-1894
ISSN
  • 1063-6692 (ISSN-L)
  • 1558-2566
OpenAlex
W2031794885
Cited by
156
References
53
Citations by year
2026: 1 · 2025: 4 · 2024: 6 · 2023: 9 · 2022: 5 · 2021: 19 · 2020: 19 · 2019: 11 · 2018: 9 · 2017: 13 · 2016: 14 · 2015: 12 · 2014: 15 · 2013: 14 · 2012: 4
FWCI
14.45
Type
journal article
Language
en
Open access
closed
Locations
  • IEEE/ACM Transactions on Networking (publishedVersion)
  • Murdoch University Research Portal (submittedVersion)
  • Swinburne figshare (Swinburne University of Technology) (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
Keywords
asymmetric traffic, traffic direction, online games, VoIP traffic, first-person shooter games, QoS management, continuous flow monitoring, data augmentation, naive Bayes, C4.5 decision tree

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review