Offline/realtime traffic classification using semi-supervised learning Export

@article{citeulike:2386441, abstract = {Identifying and categorizing network traffic by application type is challenging because of the continued evolution of applications, especially of those with a desire to be undetectable. The diminished effectiveness of port-based identification and the overheads of deep packet inspection approaches motivate us to classify traffic by exploiting distinctive flow characteristics of applications when they communicate on a network. In this paper, we explore this latter approach and propose a semi-supervised classification method that can accommodate both known and unknown applications. To the best of our knowledge, this is the first work to use semi-supervised learning techniques for the traffic classification problem. Our approach allows classifiers to be designed from training data that consists of only a few labeled and many unlabeled flows. We consider pragmatic classification issues such as longevity of classifiers and the need for retraining of classifiers. Our performance evaluation using empirical Internet traffic traces that span a 6-month period shows that: (1) high flow and byte classification accuracy (i.e., greater than 90\%) can be achieved using training data that consists of a small number of labeled and a large number of unlabeled flows; (2) presence of "mice" and "elephant" flows in the Internet complicates the design of classifiers, especially of those with high byte accuracy, and necessitates the use of weighted sampling techniques to obtain training flows; and (3) retraining of classifiers is necessary only when there are non-transient changes in the network usage characteristics. As a proof of concept, we implement prototype offline and realtime classification systems to demonstrate the feasibility of our approach.}, author = {Erman, Jeffrey and Mahanti, Anirban and Arlitt, Martin and Cohen, Ira and Williamson, Carey}, booktitle = {Performance 2007, 26th International Symposium on Computer Performance, Modeling, Measurements, and Evaluation}, citeulike-article-id = {2386441}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1284907.1285040}, citeulike-linkout-1 = {http://dx.doi.org/10.1016/j.peva.2007.06.014}, citeulike-linkout-2 = {http://www.sciencedirect.com/science/article/B6V13-4P2HYWY-4/2/12d5bba183d99dabc19cdfd7289ceda1}, doi = {10.1016/j.peva.2007.06.014}, journal = {Performance Evaluation}, keywords = {legacy-application, network, networking, real-time}, month = {October}, number = {9-12}, pages = {1194--1213}, posted-at = {2008-02-27 10:46:11}, priority = {5}, title = {Offline/realtime traffic classification using semi-supervised learning}, url = {http://dx.doi.org/10.1016/j.peva.2007.06.014}, volume = {64}, year = {2007} }

TY - JOUR ID - citeulike:2386441 L3 - citeulike-article-id:2386441 N2 - Identifying and categorizing network traffic by application type is challenging because of the continued evolution of applications, especially of those with a desire to be undetectable. The diminished effectiveness of port-based identification and the overheads of deep packet inspection approaches motivate us to classify traffic by exploiting distinctive flow characteristics of applications when they communicate on a network. In this paper, we explore this latter approach and propose a semi-supervised classification method that can accommodate both known and unknown applications. To the best of our knowledge, this is the first work to use semi-supervised learning techniques for the traffic classification problem. Our approach allows classifiers to be designed from training data that consists of only a few labeled and many unlabeled flows. We consider pragmatic classification issues such as longevity of classifiers and the need for retraining of classifiers. Our performance evaluation using empirical Internet traffic traces that span a 6-month period shows that: (1) high flow and byte classification accuracy (i.e., greater than 90%) can be achieved using training data that consists of a small number of labeled and a large number of unlabeled flows; (2) presence of "mice" and "elephant" flows in the Internet complicates the design of classifiers, especially of those with high byte accuracy, and necessitates the use of weighted sampling techniques to obtain training flows; and (3) retraining of classifiers is necessary only when there are non-transient changes in the network usage characteristics. As a proof of concept, we implement prototype offline and realtime classification systems to demonstrate the feasibility of our approach. IS - 9-12 JF - Performance Evaluation EP - 1213 TI - Offline/realtime traffic classification using semi-supervised learning VL - 64 T2 - Performance 2007, 26th International Symposium on Computer Performance, Modeling, Measurements, and Evaluation SP - 1194 KW - legacy-application KW - network KW - networking KW - real-time AU - Erman, Jeffrey AU - Mahanti, Anirban AU - Arlitt, Martin AU - Cohen, Ira AU - Williamson, Carey PY - 2007/10// UR - http://dx.doi.org/10.1016/j.peva.2007.06.014 ER -