On Internet Traffic Classification: A Two-Phased Machine Learning Approach

Traffic classification utilizing flow measurement enables operators to perform essential network management. flow accounting methods such as netflow are,however,considered inadequate for classification requiring additional packet-level information,host behaviour analysis,and specialized hardware limiting their practical adoption. this paper aims to overcome these challenges by proposing two-phased machine learning classification mechanism with netflow as input. the individual flow classes are derived per application through k-means and are further used to train a c5.0 decision tree classifier. as part of validation,the initial unsupervised phase used flow records of fifteen popular internet applications that were collected and independently subjected to k-means clustering to determine unique flow classes generated per application. the derived flow classes were afterwards used to train and test a supervised c5.0 based decision tree. the resulting classifier reported an average accuracy of 92.37% on approximately 3.4 million test cases increasing to 96.67% with adaptive boosting. the classifier specificity factor which accounted for differentiating content specific from supplementary flows ranged between 98.37% and 99.57%. furthermore,the computational performance and accuracy of the proposed methodology in comparison with similar machine learning techniques lead us to recommend its extension to other applications in achieving highly granular real-time traffic classification. © 2016 taimur bakhshi and bogdan ghita.