Network Traffic Classification
69296744
Towards the Deployment of Machine Learning Solutions in Network Traffic Classification: A Systematic Survey
Traffic analysis is a compound of strategies intended to find relationships, patterns, anomalies, and misconfigurations, among others things, in Internet traffic. In particular, traffic classification is a subgroup of strategies in this field that aims at identifying the application's name or type of Internet traffic. Nowadays, traffic classification has become a challenging task due to the rise of new technologies, such as traffic encryption and encapsulation, which decrease the performance of classical traffic classification strategies. Machine learning (ML) gains interest as a new direction in this field, showing signs of future success, such as knowledge extraction from encrypted traffic, and more accurate Quality of Service management. ML is fast becoming a key tool to build traffic classification solutions in real network traffic scenarios; in this sense, the purpose of this investigation is to explore the elements that allow this technique to work in the traffic classification field. Therefore, a systematic review is introduced based on the steps to achieve traffic classification by using ML techniques. The main aim is to understand and to identify the procedures followed by the existing works to achieve their goals. As a result, this survey paper finds a set of trends derived from the analysis performed on this domain; in this manner, the authors expect to outline future directions for ML based traffic classification.
IEEE Communications Surveys Tutorials
Fannia Pacheco Ernesto Exposito Mathieu Gineste Cedric Baudoin Jose Aguilar
186206893
Multitask Learning for Network Traffic Classification
Traffic classification has various applications in today's Internet, from resource allocation, billing and QoS purposes in ISPs to firewall and malware detection in clients. Classical machine learning algorithms and deep learning models have been widely used to solve the traffic classification task. However, training such models requires a large amount of labeled data. Labeling data is often the most difficult and time consuming process in building a classifier. To solve this challenge, we reformulate the traffic classification into a multi task learning framework where bandwidth requirement and duration of a flow are predicted along with the traffic class. The motivation of this approach is twofold: First, the bandwidth requirement and duration are useful in many applications, including routing, resource allocation, and QoS provisioning. Second, these two values can be obtained from each flow easily without the need for human labeling or capturing flows in a controlled and isolated environment. We show that with a large amount of easily obtainable data samples for bandwidth and duration prediction tasks, and only a few data samples for the traffic classification task, one can achieve high accuracy. Therefore, our proposed multi task learning framework obviates the need for a large labeled traffic dataset. We conduct two experiments with ISCX and QUIC public datasets and show the efficacy of our approach.
2020 29th International Conference on Computer Communications and Networks (ICCCN)
Shahbaz Rezaei Xin Liu
221120640
IoT Malware Network Traffic Classification using Visual Representation and Deep Learning
With the increase of IoT devices and technologies coming into service, Malware has risen as a challenging threat with increased infection rates and levels of sophistication. Without strong security mechanisms, a huge amount of sensitive data are exposed to vulnerabilities, and therefore, easily abused by cybercriminals to perform several illegal activities. Thus, advanced network security mechanisms that are able of performing a real time traffic analysis and mitigation of malicious traffic are required. To address this challenge, we are proposing a novel IoT malware traffic analysis approach using deep learning and visual representation for faster detection and classification of new malware (zero day malware) The detection of malicious network traffic in the proposed approach works at the package level, reducing significantly the time of detection with promising results due to the deep learning technologies used. To evaluate our proposed method performance, a dataset is constructed which consists of 1000 pcap files of normal and malware traffic that are collected from different network traffic sources. The experimental results of Residual Neural Network (ResNet50) are very promising, providing a 94.50% accuracy rate for detection of malware traffic.
2020 6th IEEE Conference on Network Softwarization (NetSoft)
Gueltoum Bendiab Stavros N Shiaeles Abdulrahman Alruban Nicholas Kolokotronis
212895614
An Improved Network Traffic Classification Model Based on a Support Vector Machine
Network traffic classification based on machine learning is an important branch of pattern recognition in computer science. It is a key technology for dynamic intelligent network management and enhanced network controllability. However, the traffic classification methods still facing severe challenges: The optimal set of features is difficult to determine. The classification method is highly dependent on the effective characteristic combination. Meanwhile, it is also important to balance the experience risk and generalization ability of the classifier. In this paper, an improved network traffic classification model based on a support vector machine is proposed. First, a filter wrapper hybrid feature selection method is proposed to solve the false deletion of combined features caused by a traditional feature selection method. Second, to balance the empirical risk and generalization ability of support vector machine (SVM) traffic classification model, an improved parameter optimization algorithm is proposed. The algorithm can dynamically adjust the quadratic search area, reduce the density of quadratic mesh generation, improve the search efficiency of the algorithm, and prevent the over fitting while optimizing the parameters. The experiments show that the improved traffic classification model achieves higher classification accuracy, lower dimension and shorter elapsed time and performs significantly better than traditional SVM and the other three typical supervised ML algorithms.
Symmetry
Jie Cao Da Wang Z J Qu Hongyu Sun Bin Li Chin-ling Chen
155772260
An innovative approach for real time network traffic classification
Abstract The growing demand for high speed transmission rates in recent years attracted research in new mechanisms for network traffic characterization and classification. Their inadequate treatment degrades the performance of important operational schemes, such as Network Survivability, Traffic Engineering, Quality of Service (QoS) and Dynamic Access Control, among others. The most common methods for traffic classification are Deep Packet Inspection (DPI) and port based classification. However, those methods are becoming obsolete, as increasingly more traffic is being encrypted and applications are using dynamic ports or ports originally assigned to other popular applications. This paper presents a classification module for video streaming traffic, based on machine learning, as a solution for network schemes that require adequate real time traffic treatment. The module adopts a new approach for the relaxation of the hypothesis of independence between the attributes of the Naive Bayes algorithm. The results show that the proposed module is a promising alternative to be applied in real time scenarios.
Comput. Networks
Klenilmar Lopes Dias Mateus Almeida Pongelupe Walmir M Caminhas Luciano de Errico
126933467
Exploratory study on Class Imbalance and solutions for Network Traffic Classification
Abstract Network Traffic Classification is a fundamental component in network management, and the fast paced advances in Machine Learning have motivated the application of learning techniques to identify network traffic. The intrinsic features of Internet networks lead to imbalanced class distributions when datasets are conformed, phenomena called Class Imbalance and that is attaching an increasing attention in many research fields. In spite of performance losses due to Class Imbalance, this issue has not been thoroughly studied in Network Traffic Classification and some previous works are limited to few solutions and/or assumed misleading methodological approaches. In this article, we deal with Class Imbalance in Network Traffic Classification, studying the presence of this phenomenon and analyzing a wide number of solutions in two different Internet environments: a lab network and a high speed backbone. Namely, we experimented with 21 data level algorithms, six ensemble methods and one cost level approach. Throughout the experiments performed, we have applied the most recent methodological aspects for imbalanced problems, such as: DOB SCV validation approach or the performance metrics assumed. And last but not least, the strategies to tune parameters and our algorithm implementations to adapt binary methods to multiclass problems are presented and shared with the research community, including two ensemble techniques used for the first time in Machine Learning to the best of our knowledge. Our experimental results reveal that some techniques mitigated Class Imbalance with interesting benefit for traffic classification models. More specifically, some algorithms reached increases greater than 8% in overall accuracy and greater than 4% in AUC ROC for the most challenging network scenario.
Neurocomputing
Santiago Egea Gomez Luis Hernandez-Callejo Belen Carro Antonio Sanchez-Esguevillas
237385982
Weakly Supervised Network Traffic Classification
Rui Aguiar
85499015
Packet based Network Traffic Classification Using Deep Learning
Recently, the advent of many network applications has led to a tremendous amount of network traffic. A network operator must provide quality of service for each application on the network. To accomplish this goal, various studies have focused on accurately classifying application network traffic. Network management requires technology to classify network traffic without the intervention of the network operator. In this study, we generate packet based datasets through our own network traffic pre processing. We train five deep learning models using the convolutional neural network (CNN) and residual network (ResNet) to perform network traffic classification. Finally, we analyze the network traffic classification performance of packet based datasets using the f1 score of the CNN and ResNet deep learning models, and demonstrate their effectiveness.
2019 International Conference on Artificial Intelligence in Information and Communication (ICAIIC)
Hyun-kyo Lim Ju-Bong Kim Joo-Seong Heo Kwihoon Kim Yong-Geun Hong Youn-Hee Han
57762214
Towards Optimizing WLANs Power Saving: Novel Context Aware Network Traffic Classification Based on a Machine Learning Approach
Energy is a vital resource in wireless computing systems. Despite the increasing popularity of wireless local area networks (WLANs) one of the most important outstanding issues remains the power consumption caused by wireless network interface controller. To save this energy and reduce the overall power consumption of wireless devices, most approaches proposed to date are focused on static and adaptive power saving modes. Existing literature has highlighted several issues and limitations in regards to their power consumption and performance degradation, warranting the need for further enhancements. In this paper, we propose a novel context aware network traffic classification approach based on machine learning (ML) classifiers for optimizing WLAN power saving. The levels of traffic interaction in the background are contextually exploited for application of ML classifiers. Finally, the classified output traffic is used to optimize our proposed context aware listen interval power saving modes. A real world dataset is recorded, based on nine smartphone applications' network traffic, reflecting different types of network behavior and interaction. This is used to evaluate the performance of eight ML classifiers in this initial study. The comparative results show that more than 99% of accuracy can be achieved. This paper indicates that ML classifiers are suited for classifying smartphone applications' network traffic based on the levels of interaction in the background.
IEEE Access
Ahmed Saeed Mario Kolberg
198145335
Black box Adversarial Machine Learning Attack on Network Traffic Classification
Deep machine learning techniques have shown promising results in network traffic classification, however, the robustness of these techniques under adversarial threats is still in question. Deep machine learning models are found vulnerable to small carefully crafted adversarial perturbations posing a major question on the performance of deep machine learning techniques. In this paper, we propose a black box adversarial attack on network traffic classification. The proposed attack successfully evades deep machine learning based classifiers which highlights the potential security threat of using deep machine learning techniques to realize autonomous networks.
2019 15th International Wireless Communications Mobile Computing Conference (IWCMC)
Muhammad Usama Adnan Qayyum Junaid Qadir Ala Al-Fuqaha