Bayesian Neural Networks for Internet Traffic Classification
Abstract
Internet traffic identification is an important tool for network management. It allows operators to better predict future traffic matrices and demands, security personnel to detect anomalous behavior, and researchers to develop more realistic traffic models. We present here a traffic classifier that can achieve a high accuracy across a range of application types without any source or destination host-address or port information. We use supervised machine learning based on a Bayesian trained neural network. Though our technique uses training data with categories derived from packet content, training and testing were done using features derived from packet streams consisting of one or more packet headers. By providing classification without access to the contents of packets, our technique offers wider application than methods that require full packet/payloads for classification. This is a powerful advantage, using samples of classified traffic to permit the categorization of traffic based only upon commonly available information.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The accuracy of traffic classification can be increased to over 99% by using the discriminative MLP-NN classifier to assign membership probabilities to flows.
“The accuracy of traffic classification can be increased to over 99%, by using the discriminative MLP-NN classifier to assign membership probabilities to flows.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [26]
MLP-NN with Bayesian trained weights increases the temporal accuracy of the classifier to 95%.
“Their MLP-NN with Bayesian trained weights (BNN) also increases the temporal accuracy of the classifier to 95%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [26]
Cites
A Mathematical Theory of Communication
Shannon, C. E. (1948) · Bell System Technical Journal · doi:10.1002/j.1538-7305.1948.tb00917.x · Cited by 49,574 · see citing works
Neural networks for pattern recognition
Bishop, C. (1994) · Choice Reviews Online · doi:10.5860/choice.31-5500 · Cited by 18,537 · see citing works
Neural Networks for Pattern Recognition
Bishop, C. M. (1995) · doi:10.1093/oso/9780198538493.001.0001 · Cited by 12,287 · see citing works
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094 · see citing works
Postel, J. (1981) · SpringerReference · doi:10.1007/springerreference_27387 · Cited by 3,058 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
Feature selection for high-dimensional data: a fast correlation-based filter solution
Yu, L., & Liu, H. (2003) · Cited by 2,208 · see citing works
Postel, J. (1981) · doi:10.17487/rfc0793 · Cited by 2,122 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Self-citationMining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080118 · Cited by 1,062 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Mackay, D. J. C. (1995) · Network Computation in Neural Systems · doi:10.1088/0954-898x/6/3/011 · Cited by 915 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Self-citationWand, M. P., & Jones, M. C. (1994) · Chapman & Hall/CRC eBooks · doi:10.1201/b14876 · Cited by 768 · see citing works
Transport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460 · see citing works
Self-citationMining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080118 · Cited by 445 · see citing works
Discriminators for use in flow-based classification
Moore, A. W., Zuev, D. V., & Crogan, M. (2013) · Cited by 396 · see citing works
Self-citationBLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Bayesian event classification for intrusion detection
Kruegel, C., Mutz, D. H., Robertson, W., & Valeur, F. (2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2003.1254306 · Cited by 344 · see citing works
Profiling internet backbone traffic
Xu, K., Zhang, Z.-L., & Bhattacharyya, S. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080112 · Cited by 337 · see citing works
A parameterizable methodology for Internet traffic flow profiling
claffy, K., Braun, H.-W., & Polyzos, G. C. (1995) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.464717 · Cited by 330 · see citing works
An information-theoretic approach to traffic matrix estimation
Zhang, Y., Roughan, M., Lund, C., et al. (2003) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/863955.863990 · Cited by 307 · see citing works
Detecting anomalies in network traffic using maximum entropy estimation
Gu, Y., McCallum, A., & Towsley, D. (2005) · Internet Measurement Conference · doi:10.5555/1251086.1251118 · Cited by 305 · see citing works
Developments in Maximum Entropy Data Analysis
Gull, S. F. (1989) · Springer eBooks · doi:10.1007/978-94-015-7860-8_4 · Cited by 262 · see citing works
Self-citationDetecting anomalies in network traffic using maximum entropy estimation
Gu, Y., McCallum, A., & Towsley, D. (2005) · doi:10.1145/1330107.1330148 · Cited by 254 · see citing works
Zhang, Y., Roughan, M., Lund, C., et al. (2005) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2005.857115 · Cited by 186 · see citing works
Long-Term Forecasting of Internet Backbone Traffic
Papagiannaki, K., Taft, N., Zhang, Z.-L., & Diot, C. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2005.853437 · Cited by 150 · see citing works
Entropy of ATM traffic streams: a tool for estimating QoS parameters
Duffield, N. G., Lewis, J. T., O’Connell, N., et al. (1995) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.400654 · Cited by 145 · see citing works
Traffic Classification Using a Statistical Approach
Zuev, D., & Moore, A. W. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31966-5_25 · Cited by 140 · see citing works
Self-citationThe CoralReef Software Suite as a Tool for System and Network Administrators
Moore, D., Keys, K., Koga, R., Lagache, E., & claffy, K. (2001) · Cited by 114 · see citing works
Architecture of a network monitor
Moore, A. W., Hall, J., Kreibich, C., Harris, E. P., & Pratt, I. (2003) · Cited by 101 · see citing works
Self-citationStatistical Analysis of Network Traffic for Adaptive Faults Detection
Hajji, H. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2005.853414 · Cited by 93 · see citing works
Flow classification by histograms
Soule, A., Salamatia, K., Taft, N., et al. (2004) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1005686.1005696 · Cited by 57 · see citing works
Statistical Clustering of Internet Communication Patterns
Hernández-Campos, F., Smith, F. D., Jeffay, K., et al. (2003) · Cited by 50 · see citing works
Sparse Basis Selection: New Results and Application to Adaptive Prediction of Video Source Traffic
Atiya, A. F., Aly, M. A., & Parlos, A. G. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2005.853426 · Cited by 34 · see citing works
Load Characterization and Anomaly Detection for Voice Over IP Traffic
Mandjes, M., Saniee, I., & Stolyar, A. (2005) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2005.853427 · Cited by 30 · see citing works
The Effect of Early Packet Loss on Web Page Download Times
Hall, J., Pratt, I. A., Leslie, I., et al. (2003) · Cited by 12 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Hands-On Bayesian Neural Networks—A Tutorial for Deep Learning Users
Jospin, L. V., Laga, H., Boussaid, F., Buntine, W., & Bennamoun, M. (2022) · IEEE Computational Intelligence Magazine · doi:10.1109/mci.2022.3155327 · Cited by 879 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Soysal, M., & Schmidt, E. G. (2010) · Performance Evaluation · doi:10.1016/j.peva.2010.01.001 · Cited by 165 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
A Machine Learning Approach for Efficient Traffic Classification
Li, W., & Moore, A. W. (2007) · 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2007.2 · Cited by 154 · see citing works
Self-citationA survey of AIOps methods for failure management
Notaro, P., Cardoso, J., & Gerndt, M. (2021) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3483424 · Cited by 142 · see citing works
Digging into HTTPS: flow-based classification of webmail traffic
Schatzmann, D., Mühlbauer, W., Spyropoulos, T., & Dimitropoulos, X. (2010) · Proceedings of the 10th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1879141.1879184 · Cited by 47 · see citing works
vTC: Machine Learning Based Traffic Classification as a Virtual Network Function
He, L., Xu, C., & Luo, Y. (2016) · Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization · doi:10.1145/2876019.2876029 · Cited by 31 · see citing works
Internet Traffic Classification Using Machine Learning: A Token-based Approach
Wang, Y., Xiang, Y., & Yu, S. (2011) · 2011 14th IEEE International Conference on Computational Science and Engineering · doi:10.1109/cse.2011.58 · Cited by 15 · see citing works
- Authors
- Auld, T., Moore, A. W., & Gull, S. F.
- Affiliations
- University of Cambridge (GB)
- University of London (GB)
- Venue
- IEEE Transactions on Neural Networks
- Published
- 2007-01
- Volume
- 18
- Issue
- 1
- Pages
- 223-239
- ISSN
- 1045-9227 (ISSN-L)
- OpenAlex
- W2101222264
- Cited by
- 494
- References
- 41
- Citations by year
- 2026: 6 · 2025: 6 · 2024: 13 · 2023: 11 · 2022: 24 · 2021: 28 · 2020: 48 · 2019: 35 · 2018: 29 · 2017: 22 · 2016: 29 · 2015: 29 · 2014: 28 · 2013: 30 · 2012: 32
- FWCI
- 37.45
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Transactions on Neural Networks (publishedVersion)
- PubMed (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- internet traffic classification, Bayesian neural networks, traffic identification, packet header features, network management, anomaly detection
- MeSH terms
- Algorithms, Bayes Theorem, Pattern Recognition, Automated, Signal Processing, Computer-Assisted, Cluster Analysis, Information Storage and Retrieval, Computer Security, Neural Networks, Computer, Internet
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
