Unsupervised Machine Learning-Based Elephant and Mice Flow Identification

Internet today holds traffic from a wide range of applications, which have different requirements and constraints on the resources of a network. Hence, it is normal to find a variety of flows with dissimilar features that contend for the network resources. Consequently, the problem that appears clearly is an unfair use of these resources by particular flows. This problem exposed to the so-called elephant and mice flows through real analysis of network traffic. Therefore, this problem might lead to degrading network performance. In this paper, we proposed a framework to optimize the network performance through characterising elephant and mice flows based on network performance metrics. The framework has three parts. Principal component analysis (PCA) is used in the first part to reduce the dimensionality. The next part was responsible for partitioning the traffic into distinct groups based on performance metrics such as packet loss, round trip time (RTT), and throughput by using an unsupervised clustering method with k-means. Finally, for each cluster, flows have been identified as huge (elephant) and small (mice) based on threshold values for the predefined parameters. Our results show that there is a potential in using network performance features to cluster the network traffic and to identify mice and elephant flows based on the number of packets, flow size, and duration of flow. We analyzed a (2 GB pcap file) to build our dataset. Finally, our proposed framework is capable of characterizing mice and elephant flows based on network performance metrics for each cluster.