A real-time traffic classification approach

Real-Time traffic classification is a fundamental task for many network management decisions: by timely identifying the applications that generate traffic on a specific network link, network managers can optimize the utilization of their networks; better Quality-of-Service (QoS) can be offered to connected clients while preventing the saturation of many network resources. In addition, the timely identification of malicious traffic, or of traffic presenting anomalous patterns, can be also achieved for assuring the protection of the connected hosts and network resources. However, achieving such ability is not an easy task. The inherent complexity of current Internet applications and services together with the existence of several privacy and legal restrictions prevent the analysis of the contents of the packets, thus preventing an accurate and timely traffic classification. In this paper, we address this issue by analyzing captured Internet traffic over several classification windows, until an accurate identification decision is achieved. The use of metrics such as the packet Inter-Arrival Time and the packet length will allow us to reduce the width of the classification windows, therefore achieving real-time identification. A multi-scale decomposition is then performed for evaluating the existing frequency components and a frequency spectrum profile is obtained. This profile allows an association, using several probabilistic approaches, of the traffic with the corresponding application. The obtained results show that the proposed approach can accurately and timely identify the traffic generated by the most important Internet applications, as well as identify traffic presenting illicit patterns.