Bibliography Details

J. Erman, A. Manhanti, M. Arlitt, I. Cohen, and C. Williamson, "Offline/realitme Traffic Classification Using Semi-supervised Learning", in Perform Eval 2007, Nov 2007.

Offline/realitme Traffic Classification Using Semi-supervised Learning
Authors:	J. Erman A. Manhanti M. Arlitt I. Cohen C. Williamson
Published:	Perform Eval, 2007
URL:	https://www.sciencedirect.com/science/article/abs/pii/S0166531607000648
Entry Dates:	2009-02-11
Abstract:	Identifying and categorizing network traffic by application type is challenging because of the continued evolution of applications, especially of those with a desire to be undetectable. The diminished effectiveness of port-based identification and the overheads of deep packet inspection approaches motivate us to classify traffic by exploiting distinctive flow characteristics of applications when they communicate on a network. In this paper, we explore this latter approach and propose a semi-supervised classification method that can accommodate both known and unknown applications. To the best of our knowledge, this is the first work to use semi-supervised learning techniques for the traffic classification problem. Our approach allows classifiers to be designed from training data that consists of only a few labeled and many unlabeled flows. We consider pragmatic classification issues such as longevity of classifiers and the need for retraining of classifiers. Our performance evaluation using empirical Internet traffic traces that span a 6-month period shows that: 1) high flow and byte classification accuracy (i.e., greater than 90%) can be achieved using training data that consists of a small number of labeled and a large number of unlabeled flows; 2) presence of "mice" and "elephant" flows in the Internet complicates the design of classifiers, especially of those with high byte accuracy, and necessitates use of weighted sampling techniques to obtain training flows; and 3) retraining of classifiers is necessary only when there are non-transient changes in the network usage characteristics. As a proof of concept, we implement prototype offline and realtime classification systems to demonstrate the feasibility of our proposed classification method.
Results:	datasets: collected traces from the Internet link of the university of Calgary, and categorized as Campus, Residential and Wirless Lan; Collect full packet traces; collect forty-eight 1-hour traces, over a span of six months; a semi-supervised classification method which can accommodate both known and unknown applications; high flow and byte classification accuracy (greater than 90%);