chapter

Reviewing traffic classification

Authors:

Silvio Valenti,

Alberto Dainotti,

Antonio Pescapè,

Alessandro Finamore,

Marco MelliaAuthors Info & Claims

DataTraffic Monitoring and Analysis: from measurement, classification, and anomaly detection to quality of experience

January 2013

Pages 123 - 147

Published: 01 January 2013 Publication History

Abstract

Traffic classification has received increasing attention in the last years. It aims at offering the ability to automatically recognize the application that has generated a given stream of packets from the direct and passive observation of the individual packets, or stream of packets, flowing in the network. This ability is instrumental to a number of activities that are of extreme interest to carriers, Internet service providers and network administrators in general. Indeed, traffic classification is the basic block that is required to enable any traffic management operations, from differentiating traffic pricing and treatment (e.g., policing, shaping, etc.), to security operations (e.g., firewalling, filtering, anomaly detection, etc.).

Up to few years ago, almost any Internet application was using well-known transport layer protocol ports that easily allowed its identification. More recently, the number of applications using random or non-standard ports has dramatically increased (e.g. Skype, BitTorrent, VPNs, etc.). Moreover, often network applications are configured to use well-known protocol ports assigned to other applications (e.g. TCP port 80 originally reserved for Web traffic) attempting to disguise their presence.

For these reasons, and for the importance of correctly classifying traffic flows, novel approaches based respectively on packet inspection, statistical and machine learning techniques, and behavioral methods have been investigated and are becoming standard practice. In this chapter, we discuss the main trend in the field of traffic classification and we describe some of the main proposals of the research community.

We complete this chapter by developing two examples of behavioral classifiers: both use supervised machine learning algorithms for classifications, but each is based on different features to describe the traffic. After presenting them, we compare their performance using a large dataset, showing the benefits and drawback of each approach.

References

[1]

CAIDA, The Cooperative Association for Internet Data Analysis, http://www.caida.org/research/traffic-analysis/classification-overview/

[2]

IANA, List of assigned port numbers, http://www.iana.org/assignments/port-numbers

[3]

l7filter, Application layer packet classifier for Linux, http://l7-filter.clearfoundation.com/

[4]

Tstat, http://tstat.tlc.polito.it

[5]

Aceto, G., Dainotti, A., de Donato, W., Pescapè, A.: Portload: Taking the best of two worlds in traffic classification. In: INFOCOM IEEE Conference on Computer Communications Workshops, 15, pp. 1-5 (2010)

[6]

Bakerand, F., Fosterand, B., Sharp, C.: Cisco Architecture for Lawful Intercept in IP Networks. IETF RFC 3924 (Informational) (October 2004)

[7]

Bermolen, P., Mellia, M., Meo, M., Rossi, D., Valenti, S.: Abacus: Accurate behavioral classification of P2P-TV traffic. Elsevier Computer Networks 55(6), 1394-1411 (2011)

[8]

Bernaille, L., Teixeira, R., Salamatian, K.: Early application identification. In: Proc. of ACM CoNEXT 2006, Lisboa, PT (December 2006)

Digital Library

[9]

Carela-Espaoll, V., Barlet-Ros, P., Sole-Simo, M., Dainotti, A., de Donato, W., Pescapè, A.: K-dimensional trees for continuous traffic classification, pp. 141-154 (2010)

Digital Library

[10]

Cascarano, N., Risso, F., Este, A., Gringoli, F., Salgarelli, L., Finamore, A., Mellia, M.: Comparing P2PTV Traffic Classifiers. In: 2010 IEEE International Conference on Communications (ICC), pp. 1-6 (May 2010)

[11]

Cascarano, N., Rolando, P., Risso, F., Sisto, R.: Infant: Nfa pattern matching on gpgpu devices. Computer Communication Review 40(5), 20-26 (2010)

Digital Library

[12]

Claise, B.: Cisco Systems NetFlow Services Export Version 9. RFC 3954 (Informational) (October 2004)

[13]

Cortes, C., Vapnik, V.: Support-vector networks. Machine Learning 20, 273-297 (1995)

Digital Library

[14]

Cristianini, N., Shawe-Taylor, J.: An introduction to Support Vector Machines and Other Kernel-based Learning Methods. Cambridge University Press, New York (1999)

Digital Library

[15]

Crotti, M., Dusi, M., Gringoli, F., Salgarelli, L.: Traffic classification through simple statistical fingerprinting. ACM SIGCOMM Computer Communication Review 37(1), 5-16 (2007)

Digital Library

[16]

Dainotti, A., de Donato, W., Pescapé, A.: TIE: A Community-Oriented Traffic Classification Platform. In: Papadopouli, M., Owezarski, P., Pras, A. (eds.) TMA 2009. LNCS, vol. 5537, pp. 64-74. Springer, Heidelberg (2009)

Digital Library

[17]

Dainotti, A., de Donato, W., Pescapè, A., Salvo Rossi, P.: Classification of network traffic via packet-level hidden markov models 30, 1-5 (2008)

[18]

Dainotti, A., Pescapè, A., Kim, H.C.: Traffic classification through joint distributions of packet-level statistics. In: GLOBECOM, pp. 1-6 (2011)

[19]

Dainotti, A., Pescapé, A., Claffy, K.C.: Issues and future directions in traffic classification. IEEE Network 26(1), 35-40 (2012)

Digital Library

[20]

Dainotti, A., Pescapé, A., Sansone, C.: Early Classification of Network Traffic through Multi-classification. In: Domingo-Pascual, J., Shavitt, Y., Uhlig, S. (eds.) TMA 2011. LNCS, vol. 6613, pp. 122-135. Springer, Heidelberg (2011)

Digital Library

[21]

Dainotti, A., Pescapé, A., Sansone, C., Quintavalle, A.: Using a Behaviour Knowledge Space Approach for Detecting Unknown IP Traffic Flows. In: Sansone, C., Kittler, J., Roli, F. (eds.) MCS 2011. LNCS, vol. 6713, pp. 360-369. Springer, Heidelberg (2011)

Digital Library

[22]

Santiago del Río, P. M., Rossi, D., Gringoli, F., Nava, L., Salgarelli, L., Aracil, J.: Wirespeed statistical classification of network traffic on commodity hardware. In: ACM IMC 2012 (2012)

Digital Library

[23]

Erman, J., Arlitt, M., Mahanti, A.: Traffic classification using clustering algorithms. In: MineNet 2006: Mining Network Data (MineNet)Workshop at ACM SIGCOMM 2006, Pisa, Italy (2006)

Digital Library

[24]

Erman, J., Mahanti, A., Arlitt, M., Williamson, C.: Identifying and discriminating between web and peer-to-peer traffic in the network core. In: Proceedings of the 16th International Conference on World Wide Web, WWW2007, Banff, Alberta, Canada, pp. 883-892 (2007)

Digital Library

[25]

Finamore, A., Mellia, M., Meo, M., Rossi, D.: KISS: Stochastic Packet Inspection. In: Papadopouli, M., Owezarski, P., Pras, A. (eds.) TMA 2009. LNCS, vol. 5537, pp. 117-125. Springer, Heidelberg (2009)

Digital Library

[26]

Finamore, A., Mellia, M., Meo, M., Rossi, D.: Kiss: Stochastic packet inspection classifier for udp traffic. IEEE/ACM Transaction on Networking 18(5), 1505-1515 (2010)

Digital Library

[27]

Finamore, A., Meo, M., Rossi, D., Valenti, S.: Kiss to Abacus: A Comparison of P2PTV Traffic Classifiers. In: Ricciato, F., Mellia, M., Biersack, E. (eds.) TMA 2010. LNCS, vol. 6003, pp. 115-126. Springer, Heidelberg (2010)

Digital Library

[28]

Fu, T. Z. J., Hu, Y., Shi, X., Chiu, D. M., Lui, J.C. S.: PBS: Periodic Behavioral Spectrum of P2P Applications. In: Moon, S. B., Teixeira, R., Uhlig, S. (eds.) PAM2009. LNCS, vol. 5448, pp. 155-164. Springer, Heidelberg (2009)

Digital Library

[29]

Gringoli, F., Salgarelli, L., Dusi, M., Cascarano, N., Risso, F., Claffy, K.C.: GT: picking up the truth from the ground for internet traffic. ACM SIGCOMM Comput. Commun. Rev. 39(5), 12-18 (2009)

Digital Library

[30]

Haffner, P., Sen, S., Spatscheck, O., Wang, D.: ACAS: automated construction of application signatures. In: ACM SIGCOMM Workshop on Mining Network Data (Minenet 2005), Philadelphia, PA (August 2005)

Digital Library

[31]

Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S., Varghese, G.: Network monitoring using traffic dispersion graphs (tdgs). In: Proc. of IMC 2007, San Diego, California, USA (2007)

Digital Library

[32]

Jamshed, M., Lee, J., Moon, S., Yun, I., Kim, D., Lee, S., Yi, Y., Park, K. S.: Kargus: a highly-scalable software-based intrusion detection system (2012)

[33]

Jin, Y., Duffield, N., Haffner, P., Sen, S., Zhang, Z.-L.: Inferring applications at the network layer using collective traffic statistics. SIGMETRICS Perform. Eval. Rev. 38 (June 2010)

Digital Library

[34]

Karagiannis, T., Broido, A., Brownlee, N., Klaffy, K.C., Faloutsos, M.: Is P2P dying or just hiding? In: IEEE GLOBECOM 2004, Dallas, Texas, US (2004)

[35]

Karagiannis, T., Broido, A., Faloutsos, M., Claffy, K.C.: Transport layer identification of P2P traffic. In: 4th ACM SIGCOMM Internet Measurement Conference (IMC 2004), Taormina, IT (October 2004)

Digital Library

[36]

Karagiannis, T., Papagiannaki, K., Taft, N., Faloutsos, M.: Profiling the End Host. In: Uhlig, S., Papagiannaki, K., Bonaventure, O. (eds.) PAM 2007. LNCS, vol. 4427, pp. 186-196. Springer, Heidelberg (2007)

Digital Library

[37]

Khakpour, A. R., Liu, A.X.: High-speed flow nature identification. In: Proceedings of the 2009 29th IEEE International Conference on Distributed Computing Systems, ICDCS (2009)

Digital Library

[38]

Kim, H., Claffy, K., Fomenkov, M., Barman, D., Faloutsos, M., Lee, K.: Internet traffic classification demystified: myths, caveats, and the best practices. In: Proc. of ACM CoNEXT 2008, Madrid, Spain (2008)

Digital Library

[39]

Kohavi, R., Quinlan, R.: Decision tree discovery. In: Handbook of Data Mining and Knowledge Discovery, pp. 267-276. University Press (1999)

Digital Library

[40]

Kotsiantis, S. B.: Supervised machine learning: A review of classification techniques. In: Proceeding of the 2007 conference on Emerging Artificial Intelligence Applications in Computer Engineering: Real Word AI Systems with Applications in eHealth, HCI, Information Retrieval and Pervasive Technologies, pp. 3-24. IOS Press, Amsterdam (2007)

Digital Library

[41]

Kumar, S., Crowley, P.: Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In: Proceedings of the Annual Conference of the ACM Special Interest Group on Data Communication (SIGCOMM 2006), pp. 339-350 (2006)

Digital Library

[42]

Li, W., Canini, M., Moore, A. W., Bolla, R.: Efficient application identification and the temporal and spatial stability of classification schema. Computer Networks 53(6), 790-809 (2009)

Digital Library

[43]

Liu, Y., Xu, D., Sun, L., Liu, D.: Accurate traffic classification with multi-threaded processors. In: IEEE International Symposium on Knowledge Acquisition and Modeling Workshop, KAM (2008)

[44]

Ma, J., Levchenko, K., Kreibich, C., Savage, S., Voelker, G. M.: Unexpected means of protocol inference. In: 6th ACM SIGCOMM Internet Measurement Conference (IMC 2006), Rio de Janeiro, BR (October 2006)

Digital Library

[45]

McGregor, A., Hall, M., Lorier, P., Brunskill, J.: Flow Clustering Using Machine Learning Techniques. In: Barakat, C., Pratt, I. (eds.) PAM 2004. LNCS, vol. 3015, pp. 205-214. Springer, Heidelberg (2004)

[46]

Mellia, M., Pescapè, A., Salgarelli, L.: Traffic classification and its applications to modern networks. Computer Networks 53(6), 759-760 (2009)

Digital Library

[47]

Moore, A., Zuev, D., Crogan, M.: Discriminators for use in flow-based classification. Technical report, University of Cambridge (2005)

[48]

Moore, A. W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. In: ACM SIGMETRICS 2005, Banff, Alberta, Canada (2005)

Digital Library

[49]

Moore, D., Keys, K., Koga, R., Lagache, E., Claffy, K.C.: The coralreef software suite as a tool for system and network administrators. In: Proceedings of the 15th USENIX Conference on System Administration, San Diego, California (2001)

Digital Library

[50]

Moore, A. W., Papagiannaki, K.: Toward the Accurate Identification of Network Applications. In: Dovrolis, C. (ed.) PAM 2005. LNCS, vol. 3431, pp. 41-54. Springer, Heidelberg (2005)

Digital Library

[51]

Napa-Wine, http://www.napa-wine.eu/

[52]

Nguyen, T. T. T., Armitage, G.: A survey of techniques for internet traffic classification using machine learning. IEEE Communications Surveys & Tutorials 10(4), 56-76 (2008)

Digital Library

[53]

Paxson, V.: Bro: a system for detecting network intruders in real-time. Elsevier Comput. Netw. 31, 2435-2463 (1999)

Digital Library

[54]

Risso, F., Baldi, M., Morandi, O., Baldini, A., Monclus, P.: Lightweight, payload-based traffic classification: An experimental evaluation. In: Proc. of IEEE ICC 2008 (May 2008)

[55]

Risso, F., Cascarano, N.: Diffinder, http://netgroup.polito.it/research-projects/l7-traffic-classification

[56]

Roesch, M.: Snort - lightweight intrusion detection for networks. In: Proceedings of the 13th USENIX Conference on System Administration, LISA 1999, pp. 229-238. USENIX Association (1999)

Digital Library

[57]

Rossi, D., Valenti, S.: Fine-grained traffic classification with Netflow data. In: TRaffic Analysis and Classification (TRAC)Workshop at IWCMC 2010, Caen, France (June 2010)

Digital Library

[58]

Roughan, M., Sen, S., Spatscheck, O., Duffield, N.: Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification. In: ACM SIGCOMM Internet Measurement Conference (IMC 2004), Taormina, IT (October 2004)

Digital Library

[59]

Salgarelli, L., Gringoli, F., Karagiannis, T.: Comparing traffic classifiers. ACM SIGCOMM Comp. Comm. Rev. 37(3), 65-68 (2007)

Digital Library

[60]

Sen, S., Spatscheck, O., Wang, D.: Accurate, scalable in-network identification of p2p traffic using application signatures. In: 13th International Conference on World Wide Web (WWW 2004), New York, NY, US (May 2004)

Digital Library

[61]

Lim, Y. S., Kim, H., Jeong, J., Kim, C. K., Kwon, T. T., Choi, Y.: Internet traffic classification demystified: on the sources of the discriminative power. In: CoNEXT, p. 9 (2010)

Digital Library

[62]

Szabó, G., Gódor, I., Veres, A., Malomsoky, S., Molnár, S.: Traffic classification over Gbit speed with commodity hardware. IEEE J. Communications Software and Systems 5 (2010)

[63]

Valenti, S., Rossi, D., Meo, M., Mellia, M., Bermolen, P.: Accurate, Fine-Grained Classification of P2P-TV Applications by Simply Counting Packets. In: Papadopouli, M., Owezarski, P., Pras, A. (eds.) TMA 2009. LNCS, vol. 5537, pp. 84-92. Springer, Heidelberg (2009)

Digital Library

[64]

Vasiliadis, G., Polychronakis, M., Ioannidis, S.: Midea: a multi-parallel intrusion detection architecture. In: ACM Conference on Computer and Communications Security, pp. 297-308 (2011)

Digital Library

[65]

Williams, N., Zander, S., Armitage, G.: A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification. ACM SIGCOMM CCR 36(5), 5-16 (2006)

Digital Library

[66]

Wulf, W. A., Mckee, S. A.: Hitting the memory wall: Implications of the obvious. Computer Architecture News 23, 20-24 (1995)

Digital Library

[67]

Xu, K., Zhang, Z.-L., Bhattacharyya, S.: Profiling internet backbone traffic: behavior models and applications. ACM SIGCOMM Comput. Commun. Rev. 35(4), 169-180 (2005)

Digital Library

[68]

Zu, Y., Yang, M., Xu, Z., Wang, L., Tian, X., Peng, K., Dong, Q.: Gpu-based nfa implementation for memory efficient high speed regular expression matching. In: PPOPP, pp. 129-140 (2012)

Digital Library

Cited By

Shbair WCholez TFrancois JChrisment I(2021)A multi-level framework to identify HTTPS servicesNOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium10.1109/NOMS.2016.7502818(240-248)Online publication date: 10-Mar-2021
https://dl.acm.org/doi/10.1109/NOMS.2016.7502818
Yang LDong YTian WWang Z(2019)The study of new features for video traffic classificationMultimedia Tools and Applications10.1007/s11042-018-6965-678:12(15839-15859)Online publication date: 1-Jun-2019
https://dl.acm.org/doi/10.1007/s11042-018-6965-6
Doroud HAceto Gde Donato WJarchlo ELopez AGuerrero CPescape A(2018)Speeding-Up DPI Traffic Classification with Chaining2018 IEEE Global Communications Conference (GLOBECOM)10.1109/GLOCOM.2018.8648137(1-6)Online publication date: 9-Dec-2018
https://dl.acm.org/doi/10.1109/GLOCOM.2018.8648137
Show More Cited By

Reviewing traffic classification
1. Computing methodologies
  1. Machine learning
    1. Learning paradigms
      1. Supervised learning
    2. Machine learning approaches
2. Networks
  1. Network services

Recommendations

Traffic shaping and bandwidth allocation algorithms for vbr traffic
Internet Traffic Classification: A Machine Learning Approach
Traffic classification: Issues and challenges
ICNC '13: Proceedings of the 2013 International Conference on Computing, Networking and Communications (ICNC)

Traffic classification has been extensively examined in recent years, as it is widely used in network management, design, security, advertising and research. In the past few years, the traffic classification techniques have been evolved along with the ...

Comments

Information & Contributors

Information

Published In

cover image Guide books

DataTraffic Monitoring and Analysis: from measurement, classification, and anomaly detection to quality of experience

January 2013

358 pages

ISBN:9783642367830

Editors:
Ernst Biersack
Networking and Security Department, Eurécom, 450 Route des Chappes, Biot, France
,
Christian Callegari
Department of Information Engineering, University of Pisa, Via Caruso 16, Pisa, Italy
,
Maja Matijasevic
Facults of Electrical Engineering and Computing, University of Zagreb, Unska 3, Zagreb, Croatia

Publisher

Springer-Verlag

Berlin, Heidelberg

Publication History

Published: 01 January 2013

Qualifiers

Chapter

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

14
Total Citations
View Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 26 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Shbair WCholez TFrancois JChrisment I(2021)A multi-level framework to identify HTTPS servicesNOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium10.1109/NOMS.2016.7502818(240-248)Online publication date: 10-Mar-2021
https://dl.acm.org/doi/10.1109/NOMS.2016.7502818
Yang LDong YTian WWang Z(2019)The study of new features for video traffic classificationMultimedia Tools and Applications10.1007/s11042-018-6965-678:12(15839-15859)Online publication date: 1-Jun-2019
https://dl.acm.org/doi/10.1007/s11042-018-6965-6
Doroud HAceto Gde Donato WJarchlo ELopez AGuerrero CPescape A(2018)Speeding-Up DPI Traffic Classification with Chaining2018 IEEE Global Communications Conference (GLOBECOM)10.1109/GLOCOM.2018.8648137(1-6)Online publication date: 9-Dec-2018
https://dl.acm.org/doi/10.1109/GLOCOM.2018.8648137
Aceto GCiuonzo DMontieri APescap A(2018)Multi-classification approaches for classifying mobile app trafficJournal of Network and Computer Applications10.1016/j.jnca.2017.11.007103:C(131-145)Online publication date: 1-Feb-2018
https://dl.acm.org/doi/10.1016/j.jnca.2017.11.007
Zhang CWang XLi FHe QHuang M(2018)Deep learning–based network application classification for SDNTransactions on Emerging Telecommunications Technologies10.1002/ett.330229:5Online publication date: 7-May-2018
https://dl.acm.org/doi/10.1002/ett.3302
Dubin RDvir APele OHadar O(2017)I Know What You Saw Last Minute—Encrypted HTTP Adaptive Video Streaming Title ClassificationIEEE Transactions on Information Forensics and Security10.1109/TIFS.2017.273081912:12(3039-3049)Online publication date: 1-Dec-2017
https://dl.acm.org/doi/10.1109/TIFS.2017.2730819
Ducange PMannarà GMarcelloni FPecori RVecchio M(2017)A novel approach for internet traffic classification based on multi-objective evolutionary fuzzy classifiers2017 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)10.1109/FUZZ-IEEE.2017.8015662(1-6)Online publication date: 9-Jul-2017
https://dl.acm.org/doi/10.1109/FUZZ-IEEE.2017.8015662
Al-Obeidat FEl-Alfy E(2017)Hybrid multicriteria fuzzy classification of network traffic patterns, anomalies, and protocolsPersonal and Ubiquitous Computing10.1007/s00779-017-1096-z23:5-6(777-791)Online publication date: 16-Nov-2017
https://dl.acm.org/doi/10.1007/s00779-017-1096-z
Bakhshi TGhita B(2016)On Internet Traffic ClassificationJournal of Computer Networks and Communications10.1155/2016/20483022016(1)Online publication date: 1-Jun-2016
https://dl.acm.org/doi/10.1155/2016/2048302
Diyanat AKhonsari AShariatpanahi S(2016)A Dummy-Based Approach for Preserving Source Rate PrivacyIEEE Transactions on Information Forensics and Security10.1109/TIFS.2016.251505011:6(1321-1332)Online publication date: 1-Jun-2016
https://dl.acm.org/doi/10.1109/TIFS.2016.2515050
Show More Cited By

View Options

View options

Figures

Tables

Media

View Table of Conten