Internet traffic classification using bayesian analysis techniques
Abstract
Accurate traffic classification is of fundamental importance to numerous other network activities, from security monitoring to accounting, and from Quality of Service to providing operators with useful forecasts for long-term provisioning. We apply a Naïve Bayes estimator to categorize traffic by application. Uniquely, our work capitalizes on hand-classified network data, using it as input to a supervised Naïve Bayes estimator. In this paper we illustrate the high level of accuracy achievable with the \Naive Bayes estimator. We further illustrate the improved accuracy of refined variants of this estimator.Our results indicate that with the simplest of Naïve Bayes estimator we are able to achieve about 65% accuracy on per-flow classification and with two powerful refinements we can improve this value to better than 95%; this is a vast improvement over traditional techniques that achieve 50--70%. While our technique uses training data, with categories derived from packet-content, all of our training and testing was done using header-derived discriminators. We emphasize this as a powerful aspect of our approach: using samples of well-known traffic to allow the categorization of traffic using commonly available information alone.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Features that are extracted from multi-modal application classes (e.g. WWW) tend to show a non-Gaussian behavior.
“For example, in traffic classification, features that are extracted from multi-modal application classes (e.g.WWW) tend to show a non-Gaussian behavior [321].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [321]
NBKE generalizes NB and overcomes the Gaussian distribution approximation assumption.
“However, NBKE is a feasible alternate that generalizes NB and overcomes the Gaussian distribution approximation assumption.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [321]
NBKE outperforms NB with respect to training time.
“Moreover, it also outperforms NB with respect to training time.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [321]
NBKE with FCBF achieves a classification accuracy of up to 95% and a true positive rate of up to 99%.
“In this way, NBKE with FCBF achieves a classification accuracy of upto 95% and TPR of upto 99%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [321]
NBKE with FCBF achieves temporal stability by classifying new flows collected twelve months later with an accuracy of 93% and a true positive rate of 98%.
“It also achieves temporal stability by classifying new flows collected twelve months later with an accuracy of 93% and TPR of 98%.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [321]
Cites
Wide area traffic: the failure of Poisson modeling
Paxson, V., & Floyd, S. (1995) · IEEE/ACM Transactions on Networking · doi:10.1109/90.392383 · Cited by 3,721 · see citing works
A comparison of event models for naive bayes text classification
McCallum, A., & Nigam, K. (1998) · Cited by 3,289 · see citing works
Feature selection for high-dimensional data: a fast correlation-based filter solution
Yu, L., & Liu, H. (2003) · Cited by 2,208 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Self-citationWand, M. P., & Jones, M. C. (1994) · Chapman & Hall/CRC eBooks · doi:10.1201/b14876 · Cited by 768 · see citing works
Transport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Empirically derived analytic models of wide-area TCP connections
Paxson, V. (1994) · IEEE/ACM Transactions on Networking · doi:10.1109/90.330413 · Cited by 581 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Proceedings, Twentieth International Conference on Machine Learning
Fawcett, T. E., & Mishra, N. (2003) · AAAI Press eBooks · Cited by 371 · see citing works
Proceedings of the Twentieth International Conference on Machine Learning (ICML-2003)
Hwa, R., Osborne, M., Sarkar, A., & Steedman, M. J. (2003) · Cited by 201 · see citing works
Bayesian network anomaly pattern detection for disease outbreaks
Wong, W., Moore, A., Cooper, G. F., & D, M. M. W. M. (2003) · Cited by 177 · see citing works
Self-citationAn analysis of Internet chat systems
Dewes, C., Wichmann, A., & Feldmann, A. (2003) · doi:10.1145/948205.948214 · Cited by 149 · see citing works
Entropy of ATM traffic streams: a tool for estimating QoS parameters
Duffield, N. G., Lewis, J. T., O’Connell, N., et al. (1995) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.400654 · Cited by 145 · see citing works
The CoralReef Software Suite as a Tool for System and Network Administrators
Moore, D., Keys, K., Koga, R., Lagache, E., & claffy, K. (2001) · Cited by 114 · see citing works
Ensembles of Classifiers for Morphological Galaxy Classification
Bazell, D., & Aha, D. W. (2001) · The Astrophysical Journal · doi:10.1086/318696 · Cited by 67 · see citing works
Flow classification by histograms
Soule, A., Salamatia, K., Taft, N., et al. (2004) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1005686.1005696 · Cited by 57 · see citing works
Statistical Clustering of Internet Communication Patterns
Hernández-Campos, F., Smith, F. D., Jeffay, K., et al. (2003) · Cited by 50 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2707140 · Cited by 810 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Self-citationRobust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
BLINC: multilevel traffic classification in the dark
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1090191.1080119 · Cited by 354 · see citing works
A Machine Learning Approach for Efficient Traffic Classification
Li, W., & Moore, A. W. (2007) · 2007 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems · doi:10.1109/mascots.2007.2 · Cited by 154 · see citing works
Self-citationA survey of AIOps methods for failure management
Notaro, P., Cardoso, J., & Gerndt, M. (2021) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3483424 · Cited by 142 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
Revealing skype traffic: when randomness plays with you
Bonfiglio, D., Mellia, M., Meo, M., Rossi, D., & Tofanelli, P. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1282427.1282386 · Cited by 112 · see citing works
Internet Traffic Classification for Scalable QOS Provision
Park, J., Tyan, H.-R., & Kuo, C.-C. (2006) · 2006 IEEE International Conference on Multimedia and Expo · doi:10.1109/icme.2006.262757 · Cited by 56 · see citing works
Jayaraj, A., Venkatesh, T., & Murthy, C. S. R. (2008) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsacocn.2008.033508 · Cited by 40 · see citing works
- Authors
- Moore, A. W., & Zuev, D.
- Affiliations
- University of Cambridge (GB)
- University of Oxford (GB)
- ORCID
- Moore, Andrew W.
- Venue
- ACM SIGMETRICS Performance Evaluation Review
- Published
- 2005-06-06
- Volume
- 33
- Issue
- 1
- Pages
- 50-60
- ISSN
- 0163-5999 (ISSN-L)
- OpenAlex
- W4255738146
- Cited by
- 460
- References
- 18
- Citations by year
- 2026: 9 · 2025: 11 · 2024: 7 · 2023: 15 · 2022: 20 · 2021: 30 · 2020: 27 · 2019: 40 · 2018: 39 · 2017: 29 · 2016: 29 · 2015: 20 · 2014: 32 · 2013: 26 · 2012: 30
- FWCI
- 13.68
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ACM SIGMETRICS Performance Evaluation Review (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Text and Document Classification Technologies
- Keywords
- internet traffic classification, Naive Bayes classifier, packet header features, supervised learning, network traffic analysis, classification accuracy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
