Internet traffic classification demystified: myths, caveats, and the best practices
Abstract
Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types of traffic, but no systematic comparison of the various algorithms. This fragmented approach to traffic classification research leaves the operational community with no basis for consensus on what approach to use when, and how to interpret results. In this work we critically revisit traffic classification by conducting a thorough evaluation of three classification approaches, based on transport layer ports, host behavior, and flow features. A strength of our work is the broad range of data against which we test the three classification approaches: seven traces with payload collected in Japan, Korea, and the US. The diverse geographic locations, link characteristics and application traffic mix in these data allowed us to evaluate the approaches under a wide variety of conditions. We analyze the advantages and limitations of each approach, evaluate methods to overcome the limitations, and extract insights and recommendations for both the study and practical application of traffic classification. We make our software, classifiers, and data available for researchers interested in validating or extending this work.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Various classifiers leverage port numbers in conjunction with other techniques to improve the performance of traffic classifiers.
“Nevertheless, various classifiers leverage port numbers in conjunction with other techniques [31,56,244,417] to improve the performance of the traffic classifiers.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [244]
Generally, network traffic classification methodologies can be decomposed into four broad categories that leverage port number, packet payload, host behavior or flow features.
“Generally, network traffic classification methodologies can be decomposed into four broad categories that leverage port number, packet payload, host behavior or flow features [31,244].”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [244]
Cites
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,493 · see citing works
Witten, I. H. (2008) · Cited by 9,115 · see citing works
Selection of relevant features and examples in machine learning
Blum, A. L., & Pat Langley, B. (1997) · Artificial Intelligence · doi:10.1016/s0004-3702(97)00063-5 · Cited by 3,294 · see citing works
(1998) · Cited by 2,679 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. V. (2005) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/1064212.1064220 · Cited by 1,216 · see citing works
Mining anomalies using traffic feature distributions
Lakhina, A., Crovella, M. E., & Diot, C. (2005) · ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) · doi:10.1145/1080091.1080118 · Cited by 1,062 · see citing works
Karagiannis, T., Papagiannaki, K., & Faloutsos, M. (2005) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1080091.1080119 · Cited by 997 · see citing works
Self-citationAccurate, scalable in-network identification of p2p traffic using application signatures
Sen, S. B., Spatscheck, O., & Wang, D. (2004) · International World Wide Web Conference (WWW) · doi:10.1145/988672.988742 · Cited by 807 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Traffic classification using clustering algorithms
Erman, J., Arlitt, M. F., & Mahanti, A. (2006) · doi:10.1145/1162678.1162679 · Cited by 712 · see citing works
Transport layer identification of P2P traffic
Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1028788.1028804 · Cited by 708 · see citing works
Self-citationWilliams, N., Zander, S., & Armitage, G. J. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1163593.1163596 · Cited by 698 · see citing works
Bennett, K. P., & Campbell, C. (2000) · ACM SIGKDD Explorations Newsletter · doi:10.1145/380995.380999 · Cited by 689 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Flow Clustering Using Machine Learning Techniques
McGregor, A., Hall, M., Lorier, P., & Brunskill, J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24668-8_21 · Cited by 521 · see citing works
Automated traffic classification and application identification using machine learning
Zander, S., Nguyen, T., & Armitage, G. (2005) · The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l · doi:10.1109/lcn.2005.35 · Cited by 517 · see citing works
Bayesian Neural Networks for Internet Traffic Classification
Auld, T., Moore, A. W., & Gull, S. F. (2007) · IEEE Transactions on Neural Networks · doi:10.1109/tnn.2006.883010 · Cited by 494 · see citing works
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494 · see citing works
Traffic classification through simple statistical fingerprinting
Crotti, M., Dusi, M., Gringoli, F., & Salgarelli, L. (2007) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1198255.1198257 · Cited by 396 · see citing works
Haffner, P., Sen, S. B., Spatscheck, O., & Wang, D. (2005) · doi:10.1145/1080173.1080183 · Cited by 376 · see citing works
Early application identification
Bernaille, L., Teixeira, R., & Salamatian, K. (2006) · Proceedings of the 2006 ACM CoNEXT conference on - CoNEXT '06 · doi:10.1145/1368436.1368445 · Cited by 374 · see citing works
A parameterizable methodology for Internet traffic flow profiling
claffy, K., Braun, H.-W., & Polyzos, G. C. (1995) · IEEE Journal on Selected Areas in Communications · doi:10.1109/49.464717 · Cited by 330 · see citing works
Self-citationOffline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287 · see citing works
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213 · see citing works
Unexpected means of protocol inference
Ma, J., Levchenko, K., Kreibich, C., Savage, S., & Voelker, G. M. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177123 · Cited by 204 · see citing works
Network monitoring using traffic dispersion graphs (tdgs)
Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S. R., & Varghese, G. (2007) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298349 · Cited by 190 · see citing works
Self-citationDynamic application-layer protocol analysis for network intrusion detection
Dreger, H., Feldmann, A., Mai, M., Paxson, V., & Sommer, R. (2006) · MPG.PuRe (Max Planck Society) · Cited by 180 · see citing works
A measurement study of correlations of Internet flow characteristics
Lan, K.-C., & Heidemann, J. (2005) · Computer Networks · doi:10.1016/j.comnet.2005.02.008 · Cited by 173 · see citing works
Thu, T. N. T., & Armitage, G. J. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322122 · Cited by 123 · see citing works
Allman, M. C., Paxson, V., & Terrell, J. (2007) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298316 · Cited by 122 · see citing works
Accurate Classification of the Internet Traffic Based on the SVM Method
Li, Z., Yuan, R., & Guan, X. (2007) · International Conference on Communications · doi:10.1109/icc.2007.231 · Cited by 118 · see citing works
Extraction and analysis of forensic document examiner features used for writer identification
Pervouchine, V., & Leedham, G. (2006) · Pattern Recognition · doi:10.1016/j.patcog.2006.08.008 · Cited by 107 · see citing works
Erman, J., Mahanti, A., & Arlitt, M. F. (2007) · doi:10.1145/1269880.1269890 · Cited by 51 · see citing works
Evaluating machine learning algorithms for automated network application identification
Williams, N., Zander, S., & Armitage, G. J. (2006) · Swinburne figshare (Swinburne University of Technology) · doi:10.25916/sut.26285851 · Cited by 50 · see citing works
Redundant feature elimination for multi-class problems
Appice, A., Ceci, M., Rawles, S., et al. (2004) · doi:10.1145/1015330.1015397 · Cited by 47 · see citing works
Content-aware Internet application traffic measurement and analysis
Choi, T., Kim, C., Yoon, S., Park, J., Lee, B. J., Kim, H., Chung, H., & Jeong, T. S. (2004) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms.2004.1317737 · Cited by 45 · see citing works
Self-citationFiuczynski, M. E. (2006) · ACM SIGOPS Operating Systems Review · doi:10.1145/1113361.1113366 · Cited by 15 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
Issues and future directions in traffic classification
Dainotti, A., Pescape, A., & Claffy, K. (2012) · IEEE Network · doi:10.1109/mnet.2012.6135854 · Cited by 630 · see citing works
Self-citationRobust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391 · see citing works
Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K. (2010) · Proceedings of the 6th International COnference · doi:10.1145/1921168.1921179 · Cited by 295 · see citing works
Internet Traffic Classification by Aggregating Correlated Naive Bayes Predictions
Zhang, J., Chen, C., Xiang, Y., Zhou, W., & Xiang, Y. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2012.2223675 · Cited by 175 · see citing works
Machine Learning in Software Defined Networks: Data collection and traffic classification
Amaral, P., Dinis, J., Pinto, P., Bernardo, L., Tavares, J., & Mamede, H. S. (2016) · 2016 IEEE 24th International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2016.7785327 · Cited by 172 · see citing works
Timely and Continuous Machine-Learning-Based Classification for Interactive IP Traffic
Nguyen, T. T. T., Armitage, G., Branch, P., & Zander, S. (2012) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2012.2187305 · Cited by 156 · see citing works
KISS: Stochastic Packet Inspection Classifier for UDP Traffic
Finamore, A., Mellia, M., Meo, M., & Rossi, D. (2010) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2010.2044046 · Cited by 130 · see citing works
Abacus: Accurate behavioral classification of P2P-TV traffic
Bermolen, P., Mellia, M., Meo, M., Rossi, D., & Valenti, S. (2011) · Computer Networks · doi:10.1016/j.comnet.2010.12.004 · Cited by 67 · see citing works
A multi-level framework to identify HTTPS services
Shbair, W. M., Cholez, T., Francois, J., & Chrisment, I. (2016) · NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium · doi:10.1109/noms.2016.7502818 · Cited by 69 · see citing works
Digging into HTTPS: flow-based classification of webmail traffic
Schatzmann, D., Mühlbauer, W., Spyropoulos, T., & Dimitropoulos, X. (2010) · Proceedings of the 10th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1879141.1879184 · Cited by 47 · see citing works
Krishnaveni, S., Chen, T. M., Sathiyanarayanan, M., & Amutha, B. (2024) · Cluster Computing · doi:10.1007/s10586-024-04320-x · Cited by 44 · see citing works
- Authors
- Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., & Lee, K.
- Affiliations
- Seoul National University (KR)
- University of California San Diego (US)
- University of California, Riverside (US)
- Venue
- Proceedings of the 2008 ACM CoNEXT Conference on - CONEXT '08
- Publisher
- ACM Press
- Published
- 2008
- Pages
- 1-12
- OpenAlex
- W2011628134
- Cited by
- 485
- References
- 38
- Citations by year
- 2026: 4 · 2025: 7 · 2024: 4 · 2023: 14 · 2022: 11 · 2021: 18 · 2020: 28 · 2019: 20 · 2018: 22 · 2017: 26 · 2016: 30 · 2015: 45 · 2014: 44 · 2013: 48 · 2012: 46
- FWCI
- 29.23
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) (publishedVersion)
- Funders
- National Science Foundation
- San Diego Supercomputer Center
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Traffic and Congestion Control
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- internet traffic classification, host behavior, flow characteristics, network traces, classifier evaluation, network measurement
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
