Fine-grained behavioral classification in the core: the issue of flow sampling

This work studies the impact of flow sampling on the accuracy of behavioral traffic classification. More precisely, we consider the case where the traffic classification engine is located at different vantage points of the network. Usually, behavioral classification is performed close to the user access network - where all the traffic exchanged by an endpoint can be observed. In this work instead we take into account the case of a classifier placed deeper in the aggregation network - where, due to load balancing or routing issues, only part of the traffic is generally observed.