Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification
Abstract
The ability to provide different Quality of Service (QoS) guarantees to traffic from different applications is a highly desired feature for many IP network operators, particularly for enterprise networks. Although various mechanisms exist for providing QoS in the network, QoS is yet to be widely deployed. We believe that a key factor holding back widespread QoS adoption is the absence of suitable methodologies/processes for appropriately mapping the traffic from different applications to different QoS classes. This is a challenging task, because many enterprise network operators who are interested in QoS do not know all the applications running on their network, and furthermore, over recent years port-based application classification has become problematic. We argue that measurement based automated Class of Service (CoS) mapping is an important practical problem that needs to be studied.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Packet inter-arrival times are a good discriminator for bulk data transfer (e.g. FTP) and streaming applications.
“Average packet size is fairly constant in nature [492] and packet inter-arrival times are a good discriminator for bulk data transfer (e.g.FTP) and streaming applications [390].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
Average packet size and flow duration have been shown to be good discriminators.
“Average packet size and flow duration have been shown to be good discriminators [390].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
Streaming applications often behave similar to bulk data transfer applications.
“Furthermore, streaming applications often behave similar to bulk data transfer applications [390].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
Streaming applications often behave very similar to bulk data transfer applications.
“They notice that often streaming applications behave very similar to bulk data transfer applications.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
In Roughan et al.'s evaluation, k-NN outperforms LDA with the lowest error rate of 5.1% and 9.4% for four and seven class classification, respectively.
“In their evaluation, k-NN outperforms LDA with the lowest error rate of 5.1 and 9.4% for four and seven class classification, respectively.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
Roughan et al. observed that average packet size and flow duration act as good discriminators.
“However, they observe that the average packet size and flow duration act as good discriminators, hence used these in their preliminary evaluation.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [390]
Cites
The Elements of Statistical Learning
Hastie, T., Tibshirani, R., & Friedman, J. (2009) · Springer Series in Statistics · doi:10.1007/978-0-387-84858-7 · Cited by 25,970 · see citing works
The Elements of Statistical Learning
Hastie, T., Friedman, J., & Tibshirani, R. (2001) · Springer Series in Statistics · doi:10.1007/978-0-387-21606-5 · Cited by 24,162 · see citing works
An Architecture for Differentiated Service
Blake, S. L., Black, D. L., Carlson, M., Davies, E., Wang, Z., & Weiss, W. (1998) · Cited by 5,487 · see citing works
Congestion avoidance and control
Jacobson, V. L. (1995) · ACM SIGCOMM Computer Communication Review · doi:10.1145/205447.205462 · Cited by 5,323 · see citing works
Wide area traffic: the failure of Poisson modeling
Paxson, V., & Floyd, S. (1995) · IEEE/ACM Transactions on Networking · doi:10.1109/90.392383 · Cited by 3,721 · see citing works
Allman, M., Paxson, V., & Blanton, E. (2009) · doi:10.17487/rfc5681 · Cited by 2,523 · see citing works
Padhye, J. D., Firoiu, V., Towsley, D., & Kurose, J. (1998) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/285237.285291 · Cited by 2,107 · see citing works
Congestion avoidance and control
Jacobson, V. L. (1988) · ACM SIGCOMM Computer Communication Review · doi:10.1145/52325.52356 · Cited by 1,956 · see citing works
The macroscopic behavior of the TCP congestion avoidance algorithm
Mathis, M., Semke, J., Mahdavi, J., & Ott, T. J. (1997) · ACM SIGCOMM Computer Communication Review · doi:10.1145/263932.264023 · Cited by 1,496 · see citing works
Generating representative Web workloads for network and server performance evaluation
Barford, P., & Crovella, M. E. (1998) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/277851.277897 · Cited by 1,435 · see citing works
Real Time Streaming Protocol (RTSP)
Schulzrinne, H. G., Rao, A., & Lanphier, R. (1998) · doi:10.17487/rfc2326 · Cited by 1,219 · see citing works
Simulation-based comparisons of Tahoe, Reno and SACK TCP
Fall, K., & Floyd, S. (1996) · ACM SIGCOMM Computer Communication Review · doi:10.1145/235160.235162 · Cited by 1,150 · see citing works
Inferring Internet Denial-of-Service Activity
Moore, D., Voelker, G. M., & Savage, S. (2001) · doi:10.21236/ada400003 · Cited by 866 · see citing works
A signal analysis of network traffic anomalies
Barford, P., Kline, J., Plonka, D., & Ron, A. (2002) · ACM SIGCOMM Internet Measurement Workshop (IMW) · doi:10.1145/637201.637210 · Cited by 811 · see citing works
Cranor, C. D., Johnson, T. J., Spataschek, O., et al. (2003) · Proceedings - ACM-SIGMOD International Conference on Management of Data · doi:10.1145/872757.872838 · Cited by 695 · see citing works
Empirically derived analytic models of wide-area TCP connections
Paxson, V. (1994) · IEEE/ACM Transactions on Networking · doi:10.1109/90.330413 · Cited by 581 · see citing works
Feldmann, A., Gilbert, A. C., & Willinger, W. (1998) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication (SIGCOMM) · doi:10.1145/285237.285256 · Cited by 388 · see citing works
Connections with multiple congested gateways in packet-switched networks part 1
Floyd, S. (1991) · ACM SIGCOMM Computer Communication Review · doi:10.1145/122431.122434 · Cited by 385 · see citing works
Automatically inferring patterns of resource consumption in network traffic
Estan, C., Savage, S., & Varghese, G. (2003) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/863955.863972 · Cited by 289 · see citing works
Measurement and analysis of a streaming-media workload
Chesire, M., Wolman, A., Voelker, G. M., et al. (2001) · USENIX Symposium on Internet Technologies and Systems · Cited by 270 · see citing works
A Framework for Differentiated Services
Ohlman, B., Davies, E., Verma, D. C., et al. (1999) · Medical Entomology and Zoology · Cited by 269 · see citing works
Self-similarity through high-variability
Willinger, W., Taqqu, M. S., Sherman, R. P., et al. (1995) · doi:10.1145/217382.217418 · Cited by 263 · see citing works
Fast, small-space algorithms for approximate histogram maintenance
Gilbert, A. C., Guha, S., Indyk, P., Kotidis, Y., Muthukrishnan, S., & Strauss, M. J. (2002) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/509907.509966 · Cited by 242 · see citing works
A stochastic model of TCP/IP with stationary random losses
Altman, E., Avrachenkov, K. E., & Barakat, C. (2000) · ACM SIGCOMM Computer Communication Review · doi:10.1145/347057.347549 · Cited by 208 · see citing works
Characteristics of network traffic flow anomalies
Barford, P., & Plonka, D. (2001) · doi:10.1145/505202.505211 · Cited by 200 · see citing works
Analysis of educational media server workloads
Almeida, J. M., Krueger, J., Eager, D. L., et al. (2001) · International Workshop on Network and Operating Systems Support for Digital Audio and Video (NOSSDAV) · doi:10.1145/378344.378348 · Cited by 174 · see citing works
An analysis of Internet chat systems
Dewes, C., Wichmann, A., & Feldmann, A. (2003) · doi:10.1145/948205.948214 · Cited by 149 · see citing works
Summary of WWW characterizations
Pitkow, J. E. (1999) · World Wide Web · doi:10.1023/a:1019284202914 · Cited by 147 · see citing works
Krishnamurthy, B. (2001) · Cited by 101 · see citing works
Internet Traffic Characterization
claffy, K. (1994) · Cited by 84 · see citing works
A stochastic model of TCP/IP with stationary random losses
Altman, E., Avrachenkov, K. E., & Barakat, C. (2000) · doi:10.1145/347059.347549 · Cited by 79 · see citing works
Zhang⋆, Y., & Paxson, V. (2000) · Cited by 78 · see citing works
Streaming Video Traffic : Characterization and Network Impact
der Merwe, J. V., Sen, S. B., & Kalmanek, C. R. (2002) · Cited by 51 · see citing works
Self-citationA Survey of Differentiated Services Proposals for the Internet
Gbaguidi, C., Einsiedler, H., Hurley, P., et al. (1998) · Cited by 6 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2707140 · Cited by 810 · see citing works
Traffic classification on the fly
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., & Salamatian, K. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1129582.1129589 · Cited by 585 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Internet traffic classification demystified: myths, caveats, and the best practices
Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K. (2008) · Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08 · doi:10.1145/1544012.1544023 · Cited by 485 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460 · see citing works
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Support Vector Machines for TCP traffic classification
Este, A., Gringoli, F., & Salgarelli, L. (2009) · Computer Networks · doi:10.1016/j.comnet.2009.05.003 · Cited by 270 · see citing works
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Soysal, M., & Schmidt, E. G. (2010) · Performance Evaluation · doi:10.1016/j.peva.2010.01.001 · Cited by 165 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
A Machine Learning Approach for Efficient Traffic Classification
Li, W., & Moore, A. W. (2007) · 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2007.2 · Cited by 154 · see citing works
A Framework for QoS-aware Traffic Classification Using Semi-supervised Machine Learning in SDNs
Wang, P., Lin, S.-C., & Luo, M. (2016) · 2016 IEEE International Conference on Services Computing (SCC) · doi:10.1109/scc.2016.133 · Cited by 155 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
Abacus: Accurate behavioral classification of P2P-TV traffic
Bermolen, P., Mellia, M., Meo, M., Rossi, D., & Valenti, S. (2011) · Computer Networks · doi:10.1016/j.comnet.2010.12.004 · Cited by 67 · see citing works
Internet Traffic Classification for Scalable QOS Provision
Park, J., Tyan, H.-R., & Kuo, C.-C. (2006) · 2006 IEEE International Conference on Multimedia and Expo · doi:10.1109/icme.2006.262757 · Cited by 56 · see citing works
Digging into HTTPS: flow-based classification of webmail traffic
Schatzmann, D., Mühlbauer, W., Spyropoulos, T., & Dimitropoulos, X. (2010) · Proceedings of the 10th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1879141.1879184 · Cited by 47 · see citing works
Solving the App-Level Classification Problem of P2P Traffic Via Optimized Support Vector Machines
Wang, R., Liu, Y., Yang, Y., & Zhou, X. (2006) · Sixth International Conference on Intelligent Systems Design and Applications · doi:10.1109/isda.2006.253893 · Cited by 28 · see citing works
Implementation Issues of Early Application Identification
Bernaille, L., & Teixeira, R. (2007) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-76809-8_14 · Cited by 11 · see citing works
- Authors
- Roughan, M., Sen, S., Spatscheck, O., & Duffield, N.
- Affiliations
- The University of Adelaide (AU)
- AT&T (United States) (US)
- Venue
- Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2004-10-25
- Pages
- 135-148
- OpenAlex
- W2171634548
- Cited by
- 494
- References
- 35
- Citations by year
- 2026: 9 · 2025: 8 · 2024: 6 · 2023: 12 · 2022: 17 · 2021: 25 · 2020: 20 · 2019: 19 · 2018: 16 · 2017: 17 · 2016: 21 · 2015: 24 · 2014: 20 · 2013: 25 · 2012: 32
- FWCI
- 10.76
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Adelaide Research & Scholarship (AR&S) (University of Adelaide) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Traffic and Congestion Control
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Keywords
- quality of service, network traffic classification, enterprise networks, IP networks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
